A targeted approach to protect shared data against poisoning attacks

Abstract

A directed anti-poisoning attack method for shared data protection belongs to the technical field of computer image processing. Technical solution: The data owner adopts an anti-poisoning attack algorithm to inject mixed poisonous substances into the training data, and then uploads the poisoned data to a third party; the data user reconstructs the traceable watermark detoxification data by inputting the downloaded poisoned data into the purchased antidote; the data owner uses the universal watermark reconstruction module U‑net to recover specific identity information from the leaked data to protect copyright; the anti-poisoning attack, detoxification reconstruction and watermark reconstruction performance are balanced through a cooling optimization method; the availability of poisoned data is reduced through boundary constraints. Beneficial effects: The present invention solves the user sharing of malicious data purchase decryption keys by generating unavailable uploaded data to deal with incredible third-party unknown threats, avoiding network overfitting of poisoned data reconstruction, and the applicable performance of single decryption matching multiple encryptions.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer image processing, and in particular relates to a method for directed countermeasures against poisoning attacks for shared data protection. Background Art

[0002] Media copyright protection such as watermark embedding technology has been widely emphasized by researchers due to its importance. Media copyright protection based on watermark properties is divided into two different categories: visual watermark and invisible watermark. Visible watermark reduces data availability because the embedding of digital marks affects valid information. In contrast to visual watermark, invisible watermark technology only makes minor modifications to the data. However, whether it is visual watermark or invisible watermark, it belongs to passive forensics, that is, copyright protection through leaked data.

[0003] Machine learning models trained on data provided by others are vulnerable to attacks because malicious data owners may inject forged or poisoned data into the training dataset, thereby destroying the performance of the neural network. Backdoor attacks can be seen as a special application of digital watermark embedding. The attacker injects tiny poisoned data with a "trigger" into the data and assigns it a uniform label. As a result, the model trained with the poisoned data will associate the "trigger" with the specified object category. Backdoor attacks mean that when the "trigger" input sample is used, the model will activate hidden behaviors, but behave normally in other cases. Chen et al. proposed a backdoor poisoning attack that can be applied under a very weak threat model. Their experiments showed that the backdoor adversary can only inject about 50 poisoned samples, while the attack success rate is as high as more than 90%. Similar to unrestricted visual watermark embedding, conventional data poisoning methods inject a large amount of poisoned data into the dataset to affect the training process, so no matter how good the learned classification boundary is, the trained model becomes useless. Xiao et al. proposed several algorithms for data poisoning for SVM. Subsequently, Yang et al. studied the possibility of applying direct gradient methods to generate poisoned data for neural networks. At the same time, they proposed a data poisoning generation method based on autoencoders and reward loss functions to speed up the generation of poisoned data. Steinhardt et al. pointed out that even under the proposed data poisoning defense method, 3% of poisoned data will cause the classification accuracy of the IMDB sentiment dataset to drop by 11%.

[0004] Adversarial model attacks contain two types, Trojan attacks and adversarial attacks. Due to the complexity of training and the consumption of computing resources, pre-trained deep learning models are widely used as feature extractors in various computer vision fields. However, the opacity of the training process of pre-trained models has raised questions about whether the models are subject to Trojan attacks. Trojan attacks refer to the injection of malicious behaviors, such as backdoors, into deep learning models during training. Therefore, Trojan attacks pose potential hazards to the field of computer vision and should be considered before applying pre-trained models. Gao et al. constructed a deliberate runtime Trojan attack detection model based on STRong and focused on visual models. The researchers intentionally perturbed the input by superimposing various object features to observe the randomness of the output of the perturbed input from the trained model to identify malicious or benign samples.

[0005] Adversarial attacks aim to deceive well-trained deep learning models, specified models in white-box attacks, and unknown models in black-box attacks. Researchers carefully designed adversarial perturbations to generate contaminated samples that are visually indistinguishable from benign samples. Initial adversarial attacks were based on gradient backpropagation values, such as the fast gradient sign method (FGSM) that generates adversarial examples by updating gradients in one step. Basic iterative methods reduced single-step perturbations and generated adversarial examples through multiple iterations. Next, Carlini and Wagner solved the problem of ambiguous gradients through optimization strategies. The universal attack method deliberately designs a universal perturbation that can be used for all inputs. In addition, attacks on various fields are also interesting, such as attacks on semantic segmentation and object detection, black-box attacks on audio systems, and attacks on image caption models. Summary of the invention

[0006] The present invention considers data protection in a poisoned data sharing mode, in which data owners can upload their valuable data to an untrusted third party (such as the cloud) for potential users to view. The present invention follows the traditional data sharing method, which is to upload processed (i.e. compressed) data to the Internet and then send the encrypted key to the other party after the two parties reach an agreement. Due to potential problems such as data abuse and unofficial encrypted data sharing, the present invention must emphasize the importance of embedding watermarks on the uploaded poisoned data in the data sharing mode.

[0007] The technical solution is as follows:

[0008] A method for protecting shared data against poisoning attacks, the steps are as follows:

[0009] S1. The data owner uses an adversarial poisoning attack algorithm to inject mixed toxic substances into the training data, and then uploads the poisoned data to a third party;

[0010] S2, the data user reconstructs the traceable watermarked detoxified data by inputting the downloaded poisoned data into the purchased detoxifier;

[0011] S3, the data owner uses the universal watermark reconstruction module U-net to recover specific identity information from the leaked data to protect copyright;

[0012] S4. Balance the performance of anti-poisoning attacks, detoxification reconstruction and watermark reconstruction through cooling optimization methods; reduce the availability of poisoned data through boundary constraints.

[0013] Furthermore, the specific steps of step S1 are as follows:

[0014] T1. Using classification networks to understand and construct data distribution:

[0015] Given a set of clean samples I = {i1, i2…, i n} and a pre-assigned label set L, the attacker feeds I into the training model to update the parameters of model M,

[0016]

[0017] where θ M represents the model parameters, represents the updating of model parameters by minimizing the loss function, and P represents the probability of label L appearing;

[0018] T2. Migrate data to other distribution domains, making the ordered training data distribution chaotic:

[0019] The training set is divided into two categories, A and B, and a two-stream adversarial attack poisoning network is introduced. Then, samples are randomly selected from A and B as the target mapping of the corresponding objects, and the attack network is optimized. As the model weights are updated, the characteristics of the adversarial poisoning samples are different from the original samples, and the equivalent distribution of the training and test sets is destroyed.

[0020]

[0021] Where F represents the feature extraction network, J A / B is the data distribution shift perturbation, and {*;*} represents feature juxtaposition, T A represents the migration feature from B to A, A represents any data of the first category after data segmentation, θ F represents the feature extraction network parameters, J A represents the aggregate network, θ J represents the aggregate network parameters, Indicates minimizing the loss function to update the network parameters, L mrepresents the optimization loss function from B to A, L represents the cross entropy loss function, L A represents the label of A, B represents any data of the second category after data segmentation, θ M represents the model parameters in T1;

[0022] T3. Introduce bounded constraints to optimize modules to affect the equivalent distribution of data sets:

[0023]

[0024] Where MIN represents the lower limit of the transmission noise, MAX represents the upper limit of the transmission distribution between data sets, and L b Indicates bounded constraints, min means obtaining the smaller value of the two, T B represents the migration feature from A to B, max represents the larger value of the two, abs represents the absolute value, ||T A ||2 represents the second general number of the migration feature of A, ||T B ||2 represents the binary number of B migration features.

[0025] Furthermore, the specific steps of step S2 are as follows:

[0026] U1. Detoxification and reconstruction:

[0027] The L2-norm function is used as the reconstruction loss between the poison extracted by the detoxification reconstruction module and the poison embedded by the anti-poisoning attack module.

[0028]

[0029] in Represents minimizing the loss function to optimize network parameters, L r represents the reconstruction loss, represents the reconstruction features from A to B, Represents the reconstruction features from B to A;

[0030] U2, Identity information watermark embedding:

[0031] Embed the specified watermark into the reconstructed data to identify malicious sharers by extracting specific watermark information from unofficial shared data,

[0032]

[0033] Among them, F w1 and F w2 They represent the embedded watermark features for detoxification data and the embedded watermark features for original data extracted by the double convolutional layer, respectively. represents the aggregate network for poisoned samples, F *represents the feature extraction network for poisoned samples, A + represents the sample A after poisoning, Indicates F * Network parameters, B + represents the sample B after poisoning, Represents the feature aggregation network of the poisoned samples;

[0034] U3, using multiple embedding-single extraction identity information embedding mode:

[0035] F w1 It is identity information randomly selected from a set of identifiable watermark IDs.

[0036]

[0037] Where T A / B Indicates the migration characteristics from B to A or from A to B.

[0038] Furthermore, the specific steps of step S4 are as follows:

[0039] F1. Use cooling optimization strategy to balance the fight against poisoning attacks and detoxification and reconstruction:

[0040] First, we set the temperature T in the regression process so that the poisoned data is mapped into a randomly selected region of the target data distribution:

[0041]

[0042] Where T is the temperature set and s represents the optimization span, Indicates minimizing the loss function to optimize network parameters, -L m,s represents the optimization loss function from B to A at time s, T s Indicates the temperature value at time s;

[0043] F2. Split the watermark reconstruction and poisoning and detoxification modules:

[0044] The adversarial poisoning-detoxification task is used to dynamically separate the watermark reconstruction constraints, and the watermark reconstruction sigmoid output and the predefined binary image w are used to calculate the average value of the watermark reconstruction accuracy WRA:

[0045]

[0046] Where WRA represents the watermark reconstruction accuracy, ∑ represents accumulation, U-net is the end-to-end network model, and I * represents the reconstructed sample, θ U represents the U-net network parameters, w represents the predefined watermark, Indicates the average watermark reconstruction accuracy, len() indicates the length of the obtained sample;

[0047] On this basis, the reconstructed difference is modified to:

[0048]

[0049] in represents the minimization of the loss function to update the model parameters, represents the reconstruction difference loss;

[0050] F3, using end-to-end optimization strategy function:

[0051] Combined with bounded constraints L for destroying the equivalence distribution of data sets b and watermark reconstruction module The final end-to-end optimization loss function is formulated as:

[0052]

[0053] Where L b Represents a bounded constraint.

[0054] The beneficial effects of the present invention are:

[0055] The method for targeted anti-poisoning attack for shared data protection described in the present invention is mainly aimed at data protection in the data sharing mode, focusing on generating shared data that allows potential users to view but is not yet ready for work, and reconstructing data from poisoned data without touching the original data. The following core problems are solved, including responding to unknown threats from incredible third parties by generating unusable uploaded data, avoiding poisoned data reconstruction with network overfitting, and the applicability of single decryption matching multiple encryptions to solve the sharing of users who purchase decryption keys for malicious data. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of data protection mode under data sharing;

[0057] Figure 2 Directed countermeasures against poisoning attacks flow chart;

[0058] Figure 3 Specific network structure diagram for targeted countermeasures against poisoning attacks. DETAILED DESCRIPTION

[0059] The following will refer to the attached Figure 1-3 A method for protecting shared data against directed poisoning attacks according to the present invention is described in more detail.

[0060] Example 1

[0061] In order to improve the security of data in data sharing mode, the present invention proposes a targeted anti-poisoning attack strategy for shared data protection. The method designs a new double-distilled structure targeted anti-poisoning attack model, which includes three parts: anti-poisoning attack module, detoxification reconstruction module and watermark reconstruction module.

[0062] The technical solution is as follows:

[0063] A method for protecting shared data against poisoning attacks, the steps are as follows:

[0064] S1. The data owner adopts adversarial poisoning attack algorithm to inject mixed poisonous substances into the training data, and then uploads the poisoned data to an unbelievable third party.

[0065] S2. Data users reconstruct traceable watermarked detoxified data by inputting the downloaded poisoned data into the purchased detoxifier.

[0066] S3. The data owner uses the universal watermark reconstruction module U-net to recover specific identity information from the leaked data to protect copyright.

[0067] S4. In order to balance the performance of anti-poisoning attacks, detoxification reconstruction and watermark reconstruction, we propose a cooling optimization strategy. In addition, the present invention proposes a boundary constraint to indirectly reduce the availability of poisoned data.

[0068] The idea flow of the invention is as follows Figure 2 As shown, it is the flow chart of the double distillation structure pointing data sharing framework.

[0069] Furthermore, S1 can be divided into the following steps:

[0070] T1. Understand and structure data distribution using efficient classification networks.

[0071] Given a set of clean samples I = {i1, i2…, i n} and a pre-assigned label set L, the attacker feeds I into the training model to update the parameters of model M.

[0072]

[0073] T2. Migrate data to other distribution domains, making the ordered training data distribution chaotic.

[0074] To this end, the present invention divides the training set into two categories, A and B, and introduces a two-stream adversarial attack poisoning network. Then, samples are randomly selected from A and B as the target mapping of the corresponding object, and the attack network is optimized. As the model weights are updated, the characteristics of the adversarial poisoning samples are different from the original samples, and eventually, the equivalent distribution of the training and test sets will be destroyed.

[0075]

[0076] Where F represents the feature extraction network, J A / B is the data distribution shift perturbation, and {*;*} indicates feature juxtaposition.

[0077] T3. Introduce bounded constraints to optimize modules to influence the equivalent distribution of data sets.

[0078] The bounded constraints make the module produce more perturbations than adversarial attacks and keep the distribution balanced among datasets.

[0079]

[0080] Where MIN represents the lower limit of transmission noise, and MAX represents the upper limit of transmission distribution between data sets. For convenience, in the following sections, the present invention denotes the anti-poisoning attack module as AP.

[0081] S2 can be divided into the following steps:

[0082] U1. Detoxification and reconstruction.

[0083] The L2-norm function is used as the reconstruction loss between the poison extracted by the detoxification reconstruction module and the poison embedded by the anti-poisoning attack module.

[0084]

[0085] U2. Identity information watermark embedding.

[0086] The specified watermark is embedded into the reconstructed data to identify malicious sharers by extracting specific watermark information from unofficial shared data.

[0087]

[0088] Among them, F w1 and F w2 Denote the embedded watermark features extracted by the double convolutional layer for the detoxified data and the original data, respectively.

[0089] U3. Multiple embedding-single extraction identity information embedding mode.

[0090] The single encryption and decryption method cannot distinguish the specific user identity, so the present invention introduces a multi-embedded single extraction recognition mode. Specifically, F w1 It is identity information randomly selected from a set of identifiable watermark IDs.

[0091]

[0092] S4 can be divided into the following steps:

[0093] F1. Cooling optimization strategy to balance the fight against poisoning attacks and detoxification and reconstruction

[0094] The present invention first sets a higher temperature T in the regression process so that the poisoned data can be effectively mapped to the randomly selected target data distribution area. Then, the cooling strategy gradually reduces the constraints on the data distribution mapping and pays more attention to the data reconstruction process, successfully achieving a smaller data reconstruction loss while ensuring a higher data distribution mobility.

[0095]

[0096] T is the temperature set and s represents the optimization span.

[0097] F2. Split of watermark reconstruction and poisoning and detoxification modules

[0098] Considering the uncertainty of multiple embeddings, the present invention uses adversarial poisoning-detoxification tasks to dynamically separate watermark reconstruction constraints. To this end, the present invention uses the watermark reconstruction sigmoid output and the predefined binary image w to calculate the average value of the watermark reconstruction accuracy WRA.

[0099]

[0100] On this basis, the reconstructed difference is modified to:

[0101]

[0102] F3. End-to-end optimization strategy function

[0103] Combined with bounded constraints L for destroying the equivalence distribution of data sets b and watermark reconstruction module The final end-to-end optimization loss function is formulated as:

[0104]

[0105] Example 2

[0106] Given a newly collected dataset D with sufficient commercial value, this section mainly considers how to protect the dataset in a data sharing mode, that is, shared data that allows potential users to watch but is not yet ready for work. The current section only considers a few core competitive factors, including coping with unknown threats from incredible third parties by generating unusable uploaded data, poisoned data reconstruction to avoid network overfitting, and applicable performance of single decryption matched with multiple encryptions to address malicious data sharing by users who purchase decryption keys. Specifically, the data owner automatically injects mixed poisons into the training data and then uploads the poisoned data D+ to the cloud. Next, the data user inputs the downloaded poisoned data into the purchased detoxification dedicated device to recover the traceable watermarked detoxified data D*. Finally, the data owner adopts a general watermark reconstruction module to recover specific embedded information from the leaked data to protect copyright.

[0107] 1. Fight against poisoning attacks

[0108] Typical adversarial attacks are closely related to specific machine learning models. However, the limited knowledge obtained from the dataset cannot cover all situations in the real world, which can lead to prediction bias. Attackers exploit these "knowledge blind spots" to mislead well-trained models by adding subtle invisible perturbations to benign samples under the guidance of constrained gradients. Specifically, given a set of clean samples I = {i1, i2…, i n} and the pre-assigned label set L, the attacker will feed I into the training model to obtain the corresponding logical value O = {o1, o2…, o n}, and then according to the label L and the logical value O. The specific formula is as follows:

[0109]

[0110] Unlike adversarial attacks, data poisoning aims to modify data before training. In the recently popular data poisoning algorithm, the attacker uses a "trigger" to inject tiny poisoned data into the training data to activate the backdoor effect. That is, the "trigger" data training model associates the "trigger" with a specified label.

[0111] In this work, the present invention combines the concepts of adversarial attack and data poisoning to design an adversarial poisoning attack module, which is used to destroy the data equivalent distribution. Prior to this, the present invention first uses the time-tested and efficient network to understand and construct the data distribution.

[0112]

[0113] Then, the present invention intentionally transfers the data to other distribution domains, which causes the ordered distribution of training data to become chaotic. To this end, the present invention divides the training set into two categories, A and B, and introduces a two-stream adversarial attack poisoning network. The present invention randomly selects samples from A and B as target mappings of corresponding objects and optimizes the attack network. As the model weights are updated, the characteristics of the adversarial poisoning samples are different from the original samples, and eventually, the equivalent distribution of the training test set will be destroyed.

[0114]

[0115] Where F represents the feature extraction network, J A / B is a data distribution shift perturbation, and {*;*} represents feature juxtaposition. Therefore, the adversarial poisoning attack module targets well-trained models and high-quality labeled datasets. Unlike conventional data poisoning, the present invention uses a well-trained module to automatically inject various poisonous substances into the entire training set, rather than a part of it, because the user can manually delete the poisoned data from the dataset, or use data statistics to remove the identified watermarks from the poisoned data.

[0116] Furthermore, in order to better influence the equivalent distribution of data sets, the present invention introduces bounded constraints to optimize the modules, which makes the interference generated by the modules larger than the adversarial attack and maintains the distribution balance between data sets.

[0117]

[0118] Where MIN represents the lower limit of transmission noise, and MAX represents the upper limit of transmission distribution between data sets. For convenience, in the following sections, the present invention denotes the anti-poisoning attack module as AP.

[0119] 2. Targeted detoxification and reconstruction

[0120] Given a series of high-quality labeled data I that need to be protected, a well-trained anti-poisoning attack model AP, the data owner can obtain the corresponding poisoned dataset I+ and upload it to the cloud. On this basis, this section mainly considers how to reconstruct the data distribution from the poisoned dataset I+ (the reconstructed dataset, named I*), and how to embed the specified watermark into the detoxified sample. Compared with the anti-poisoning attack module, the detoxification reconstruction module removes toxins from the poisoned data. The present invention also uses a two-stream network to extract various toxic substances embedded in the poisoned data.

[0121] The present invention adopts L2-norm function as reconstruction loss between the poison extracted by the detoxification reconstruction module and the poison embedded by the anti-poisoning attack module.

[0122]

[0123] In addition, a designated watermark is embedded into the reconstructed data to identify malicious sharers by extracting specific watermark information from unofficial shared data.

[0124]

[0125] Among them, F w1 and F w2 Denote the embedded watermark features extracted by the double convolutional layer for the detoxified data and the original data, respectively.

[0126] However, the single encryption and decryption method cannot distinguish the specific user identity, so the present invention introduces a multi-embedded single extraction recognition mode. Specifically, F w1 It is identity information randomly selected from a set of identifiable watermark IDs.

[0127]

[0128] By default, the present invention uses U-net as the network structure of the watermark reconstruction module. All embedded identity information can be extracted through the watermark reconstruction network, i.e., single extraction. In order to identify the source of shared data, a simple embedded watermark is sufficient to identify the user's identity. Therefore, the present invention generates a series of single-channel binary images as standard watermarks.

[0129] The present invention inputs the output of U-net into a sigmoid function to convert it into a binary mode, in which the binary output and a standard watermark are used to measure the reconstruction difference.

[0130]

[0131] w1 and w2 are predefined watermarks for detoxified data and original data.

[0132] 3. Optimization goals

[0133] In the above sections, the present invention describes in detail the newly designed data sharing framework. Next, the present invention will show how to combine various modules and optimize them synchronously. Figure 3 As shown, PDSF includes three modules, and the present invention uses the output of each module as the input of the next module. Then, the present invention optimizes all network weights together.

[0134] In order to balance the fight against poisoning attacks and detoxification and reconstruction, the present invention introduces a well-performing cooling optimization method. That is, the present invention first sets a higher temperature T in the regression process so that the poisoned data can be effectively mapped to the randomly selected target data distribution area. Then, the cooling strategy gradually reduces the constraints on the data distribution mapping, pays more attention to the data reconstruction process, and successfully achieves a smaller data reconstruction loss while ensuring a higher data distribution mobility.

[0135]

[0136] T is the temperature set, and s represents the optimization span. In addition, considering the uncertainty of multiple embeddings, the present invention dynamically separates the watermark reconstruction constraints using adversarial poisoning-detoxification tasks. To this end, the present invention uses the watermark reconstruction sigmoid output and the predefined binary image w to calculate the average value of the watermark reconstruction accuracy WRA.

[0137]

[0138] On this basis, the reconstructed difference is modified to:

[0139]

[0140] Combined with bounded constraints L for destroying the equivalence distribution of data sets b and watermark reconstruction module The final end-to-end optimization loss function is formulated as:

[0141]

[0142] It should be noted that the above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art of the present invention, several equivalent substitutions or obvious variations can be made without departing from the concept of the present invention, and the performance or use is the same, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for protecting shared data against targeted poisoning attacks, characterized in that: Here are the steps: S1. The data owner uses an adversarial poisoning attack algorithm to inject mixed toxic substances into the training data, and then uploads the poisoned data to a third party; S2, the data user reconstructs the traceable watermarked detoxified data by inputting the downloaded poisoned data into the detoxifier network; S3, the data owner uses the universal watermark reconstruction module U-net to recover specific identity information from the leaked data to protect copyright; S4, balance the attack against poisoning, detoxification reconstruction and watermark reconstruction performance through cooling optimization method; reduce the availability of poisoned data through boundary constraints; The specific steps of step S4 are as follows: F1. Use cooling optimization strategy to balance the fight against poisoning attacks and detoxification and reconstruction: First, we set the temperature T in the regression process so that the poisoned data is mapped into a randomly selected region of the target data distribution: Where T is the temperature set and s is the time mark of the optimization span. It represents minimizing the loss function to optimize the network parameters. The training set is divided into two categories, A and B. A two-stream adversarial attack poisoning network is introduced. Then, samples are randomly selected from A and B as the target mapping of the corresponding object, and the attack network is optimized. m,s represents the optimization loss function from B to A at time s, T s Indicates the temperature value marked at time s; F2. Split the watermark reconstruction and poisoning and detoxification modules: The adversarial poisoning-detoxification task is used to dynamically separate the watermark reconstruction constraints, and the watermark reconstruction sigmoid output and the predefined binary image w are used to calculate the average value of the watermark reconstruction accuracy WRA: Where WRA represents the watermark reconstruction accuracy, ∑ represents accumulation, U-net is the end-to-end network model, and I * represents the reconstructed sample, θ U represents the U-net network parameters, w represents the predefined watermark, Indicates the average watermark reconstruction accuracy, len() indicates the length of the obtained sample; On this basis, the reconstructed difference is modified to: in represents the minimization of the loss function to update the model parameters, represents the reconstruction difference loss; F3, using end-to-end optimization strategy function: Combined with bounded constraints L for destroying the equivalence distribution of data sets b and watermark reconstruction module The final end-to-end optimization loss function is formulated as: Where L b represents bounded constraints, L r represents the 2-norm loss function used to reconstruct the watermark.

2. The method for protecting shared data against directed poisoning attacks as claimed in claim 1, characterized in that: The specific steps of step S1 are as follows: T1. Using classification networks to understand and construct data distribution: Given a set of clean samples I = {i1, i2…, i n } and a pre-assigned label set L, the attacker feeds I into the training model M to update the parameters of the training model M, where θ M represents the model parameters, represents the updating of model parameters by minimizing the loss function, and P represents the probability of label L appearing; T2. Migrate data to other distribution domains, making the ordered training data distribution chaotic: As the model weights are updated, the characteristics of the adversarial poisoned samples are different from the original samples, and the equivalent distribution of the training and test sets is destroyed; Where F represents the feature extraction network, J A / B is the data distribution shift perturbation, and {*;*} represents feature juxtaposition, T A represents the migration feature from B to A, A represents any data of the first category after data segmentation, θ F represents the feature extraction network parameters, J A represents the aggregate network, θ J represents the aggregate network parameters, Represents the minimization of the loss function to update the network parameters, L m represents the optimization loss function from B to A, L represents the cross entropy loss function, L A represents the label of A, B represents any data of the second category after data segmentation, θ M represents the model parameters in T1; T3. Introduce bounded constraints to optimize modules to affect the equivalent distribution of data sets: Where MIN represents the lower limit of the transmission noise, MAX represents the upper limit of the transmission distribution between data sets, and L b Indicates bounded constraints, min means obtaining the smaller value of the two, T B represents the migration feature from A to B, max means obtaining the larger value of the two, abs means taking the absolute value, ||T A ||2 represents the second general number of the migration feature of A, ||T B ||2 represents the binary number of B migration features.

3. The method for protecting shared data against poisoning attacks as claimed in claim 2, characterized in that: The specific steps of step S2 are as follows: U1. Detoxification and reconstruction: The L2-norm function is used as the reconstruction loss between the poison extracted by the detoxification reconstruction module and the poison embedded by the anti-poisoning attack module. in Represents minimizing the loss function to optimize network parameters, L r represents the reconstruction loss, represents the reconstruction features from A to B, Represents the reconstruction features from B to A; U2, Identity information watermark embedding: Embed the specified watermark into the reconstructed data to identify malicious sharers by extracting specific watermark information from unofficial shared data, Among them, F w1 and F w2 They represent the embedded watermark features for detoxification data and the embedded watermark features for original data extracted by the double convolutional layer, respectively. represents the aggregate network for poisoned samples, F * represents the feature extraction network for poisoned samples, A + represents the sample A after poisoning, Indicates F * Network parameters, B + represents the sample B after poisoning, Represents the feature aggregation network of the poisoned samples; U3, using multiple embedding-single extraction identity information embedding mode: F w1 It is the identity information randomly selected from a set of identifiable watermark IDs; Where T A / B Indicates the migration characteristics from B to A or from A to B.

Images