A backdoor attack defense method and system based on training process deconstruction

Abstract

The present invention discloses a backdoor attack defense method and system based on training process deconstruction, which belongs to the field of neural network security technology and can solve the problem that the existing defense model has low accuracy in predicting normal test data. The method comprises: obtaining a labeled training sample set containing backdoor poisoned data; performing de-labeling processing on the labeled training sample set to obtain an unlabeled training sample set, and inputting the unlabeled training sample set into a neural network model for feature extraction layer training; inputting the labeled training sample set into a neural network model for simple classification layer training to obtain a trained model; and using the trained model to perform category prediction on a test data set. The present invention is used for backdoor attack defense.

Description

Technical Field

[0001] The invention relates to a backdoor attack defense method and system based on training process deconstruction, belonging to the field of neural network security technology. Background Art

[0002] With the continuous development of science and technology, deep neural network models are currently being successfully applied to many security-related systems, such as face recognition, autonomous driving, and malware detection. As the scale of models increases, their demand for data is also growing. In order to achieve state-of-the-art performance, users often collect sufficient training data through automation or outsourcing. These data collected without reliable human supervision make the model extremely vulnerable to backdoor attacks. In a backdoor attack, the attacker adds a backdoor trigger to the clean data to obtain poisoned data, and the model is injected with a backdoor after training. The model with the backdoor performs well on normal test data, but will classify the test data with the backdoor trigger added as the target category specified by the attacker. Therefore, backdoor attacks are not only difficult to detect but also pose a major threat to the system.

[0003] At present, backdoor attack methods can be divided into poisoned label attack and clean label attack according to the nature of the target label. Poisoned label attack is the most mainstream attack method. There are also some defense methods in the existing technology to mitigate the threat of backdoor attack. Most of the existing defenses are empirical and can be divided into five categories, including: (1) Detection-based defense will check whether the model or test sample has been attacked, and if it has been attacked, it will be rejected; (2) Preprocessing-based defense attempts to destroy the potential backdoor trigger in the test sample to avoid activating the potential backdoor in the model; (3) Model reconstruction-based defense directly destroys the hidden backdoor by modifying the model; (4) Trigger synthesis-based defense further eliminates the impact of the backdoor by reversing the potential trigger pattern in the model; (5) Poison suppression-based defense suppresses the effectiveness of poisoned data during training to avoid the generation of backdoors. Among them, the fifth type of defense mainly destroys the strong correspondence between triggers and target labels by adding noise to training data and model gradients, but while reducing the success rate of the attack, it also affects the accuracy of the model in normal test data. Summary of the invention

[0004] The present invention provides a backdoor attack defense method and system based on training process deconstruction, which can solve the problem that the prediction results of normal test data by existing defense models have low accuracy.

[0005] On the one hand, the present invention provides a backdoor attack defense method based on training process deconstruction, the method comprising:

[0006] Step 1: Obtain a labeled training sample set containing backdoor poisoned data;

[0007] Step 2: De-label the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into a neural network model for feature extraction layer training;

[0008] Step 3: input the labeled training sample set into the neural network model to perform simple classification layer training to obtain a trained model;

[0009] Step 4: Use the trained model to perform category prediction on the test data set.

[0010] Optionally, after step 3, the method further includes:

[0011] Step 5: Obtain the training loss value of each sample in the labeled training sample set, and divide the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold;

[0012] Step 6: De-labeling the low-confidence data set, and using the high-confidence data set and the de-labeled low-confidence data set to correct the trained model to obtain a corrected model;

[0013] Accordingly, the step 4 is specifically as follows:

[0014] The corrected model is used to perform category prediction on the test data set.

[0015] Optionally, inputting the unlabeled training sample set into a neural network model to perform feature extraction layer training specifically includes:

[0016] The unlabeled training sample set is input into the neural network model, and the feature extraction layer training is performed using a self-supervised learning method.

[0017] Optionally, the step of inputting the unlabeled training sample set into a neural network model and performing feature extraction layer training using a self-supervised learning method specifically includes:

[0018] The first formula is used to obtain the feature extraction layer parameters; the first formula is:

[0019]

[0020] in, is the feature extraction layer parameter after training; represents the unlabeled training sample set, and x is a sample in the unlabeled training sample set; represents the self-supervised learning loss.

[0021] Optionally, the step 3 specifically includes:

[0022] The labeled training sample set is input into the neural network model, and a simple classification layer training is performed using a supervised learning method to obtain a trained model.

[0023] Optionally, the step of inputting the labeled training sample set into the neural network model and performing simple classification layer training using a supervised learning method to obtain a trained model specifically includes:

[0024] The second formula is used to obtain the simple classification layer parameters; the second formula is:

[0025]

[0026] in, are the parameters of the simple classification layer after training; represents the labeled training sample set, x and y are the samples and labels in the labeled training sample set respectively; Represents the predicted category of sample x; Represents supervision loss.

[0027] Optionally, step 5 specifically includes:

[0028] Obtaining the training loss value of each sample in the labeled training sample set during the simple classification layer training process;

[0029] Arrange all samples in order of training loss value from small to large to obtain a loss value sequence;

[0030] The first α% of the training samples in the loss value sequence that are less than a preset threshold are classified into the high confidence data set, and the remaining (100-α)% of the training samples in the loss value sequence are classified into the low confidence data set; where α is a hyperparameter and α∈[0,100].

[0031] Optionally, the using the high confidence data set and the unlabeled low confidence data set to correct the trained model to obtain the corrected model specifically includes:

[0032] The high-confidence data set and the unlabeled low-confidence data set are used, and a semi-supervised learning method is adopted to correct the trained model to obtain a corrected model.

[0033] Optionally, the using the high confidence data set and the unlabeled low confidence data set and adopting a semi-supervised learning method to correct the trained model to obtain the corrected model specifically includes:

[0034] The third formula is used to obtain the corrected model parameters; the third formula is:

[0035]

[0036] Among them, w * are the model parameters after correction; A high confidence dataset representing the retained labels; Represents an unlabeled low-confidence dataset; represents the semi-supervised loss.

[0037] On the other hand, the present invention provides a backdoor attack defense system based on training process deconstruction, the system comprising:

[0038] An acquisition module, used to acquire a labeled training sample set containing backdoor poisoned data;

[0039] A training module is used to perform a de-labeling process on the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into a neural network model to perform feature extraction layer training;

[0040] The training module is also used to input the labeled training sample set into the neural network model to perform simple classification layer training to obtain a trained model;

[0041] A testing module, used to use the trained model to perform category prediction on a test data set;

[0042] Optionally, the training module is also used to:

[0043] Obtaining a training loss value of each sample in the labeled training sample set, and dividing the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold;

[0044] De-labeling the low-confidence data set, and correcting the trained model using the high-confidence data set and the de-labeled low-confidence data set to obtain a corrected model;

[0045] Accordingly, the test module is specifically used for:

[0046] The corrected model is used to perform category prediction on the test data set.

[0047] The beneficial effects that the present invention can produce include:

[0048] The backdoor attack defense method based on training process deconstruction provided by the present invention first performs label removal processing on the labeled training sample set containing backdoor poisoned data, and then uses the unlabeled training sample set with the labels removed to train the feature extractor based on the self-supervised learning method, so as to map the samples with the same real category to similar positions in the feature space; then freeze the trained feature extractor, and use all the training samples to train the simple classifier through supervised learning; finally, according to the trained whole model, the training data is split into high-confidence samples with retained labels and low-confidence samples with removed labels, and the whole model is fine-tuned based on semi-supervised learning. The present invention can effectively reduce the success rate of attackers in implementing backdoor attacks, while maintaining the high accuracy of the prediction results of normal test samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Backdoor attack defense method process based on training process deconstruction provided by the embodiment of the present invention Figure 1 ;

[0050] Figure 2 Backdoor attack defense method process based on training process deconstruction provided by the embodiment of the present invention Figure 2 ;

[0051] Figure 3 A schematic diagram of the principles of a backdoor attack defense method based on training process deconstruction provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The present invention is described in detail below in conjunction with embodiments, but the present invention is not limited to these embodiments.

[0053] The backdoor defense considered in this invention can be classified as defense based on poisoning suppression, which mainly solves the problem of how to train a clean model on a labeled training sample set containing backdoor poisoned data. In this scenario, after the attacker sets the target category and trigger, the poisoned data is published on a third-party data platform; the victim downloads the poisoned data to train a local model; the purpose of this invention is to provide a safe and reliable training method to protect the victim's trained model from predicting the test sample containing the trigger as the target category, and to maintain its high accuracy on normal test data.

[0054] The present invention is described clearly and completely below in conjunction with the accompanying drawings.

[0055] like Figures 1 to 3As shown, the backdoor attack defense method based on training process deconstruction provided by the present invention aims at the problem of using a labeled training sample set containing backdoor poisoned data to train a clean model. The method deconstructs the neural network model into two parts: a feature extractor and a simple classifier. First, the labels of the labeled training sample set containing backdoor poisoned data are removed, and the feature extractor is trained based on self-supervised learning, so that samples with the same true category are mapped to similar positions in the feature space; then the trained feature extractor is frozen, and a simple classifier is trained through supervised learning using all training samples in the labeled training sample set; finally, the training sample set is split into high-confidence samples with retained labels and low-confidence samples with removed labels according to the entire trained neural network model, and the entire model is fine-tuned based on semi-supervised learning.

[0056] The specific steps include:

[0057] make represents the labeled training sample set (including the training set of backdoor poisoned data), f w : The parameter is w=[w c ,w f ], a neural network model with K categories, which will input Mapped to the output category; w c represents the feature extractor in the model, w f Represents a simple classifier in the model.

[0058] Step 1: Obtain a labeled training sample set containing backdoor poisoned data.

[0059] Step 2: De-label the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into the neural network model, and use the self-supervised learning method to train the feature extraction layer. Specifically, the first formula can be used to obtain the feature extraction layer parameters; the first formula is:

[0060]

[0061] in, is the feature extraction layer parameter after training; represents the unlabeled training sample set, and x is a sample in the unlabeled training sample set; Represents the self-supervised learning loss. In this embodiment, NT-Xent in SimCLR can be used. Since self-supervised learning is used, no data labels are used, and even if the training data contains backdoor poisoned samples, the learned feature extractor will be purified.

[0062] Step 3: Input the labeled training sample set into the neural network model, use the supervised learning method to perform simple classification layer training, and obtain the trained model.

[0063] First, freeze the trained feature extraction layer parameters in step 2. And use Train a simple classifier w through supervised learning f .

[0064] In practical applications, the second formula can be used to obtain the simple classification layer parameters; the second formula is:

[0065]

[0066] in, are the parameters of the simple classification layer after training; represents the labeled training sample set, x and y are the samples and labels in the labeled training sample set respectively; Represents supervision loss. Indicates that the parameter is The neural network model, Indicates the predicted category of sample x; inspired by label noise learning, the symmetric cross entropy loss (SCE) is used in this embodiment; compared with the standard cross entropy loss (CE), SCE can significantly amplify the difference in loss between poisoned data and clean data, thereby further reducing the risk of poisoned data being misclassified as possibility.

[0067] Step 4: Use the trained model to predict the category of the test data set.

[0068] For further reference, Figure 2 As shown, in order to obtain a more optimized neural network model, after step 3, the method further includes:

[0069] Step 5: Obtain the training loss value of each sample in the labeled training sample set, and divide the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold.

[0070] Specifically, record the training loss value of each sample in the labeled training sample set during the simple classification layer training process;

[0071] Arrange all samples in order of training loss value from small to large to obtain a loss value sequence;

[0072] The first α% of training samples in the loss value sequence that are less than the preset threshold are classified into the high confidence data set, and the remaining (100-α)% of training samples in the loss value sequence are classified into the low confidence data set; where α is a hyperparameter and α∈[0,100].

[0073] Step 6: De-label the low-confidence data set, and use the high-confidence data set and the de-labeled low-confidence data set to correct the trained model to obtain a corrected model.

[0074] Specifically, a high-confidence dataset and an unlabeled low-confidence dataset are used, and a semi-supervised learning method is used to correct the trained model to obtain a corrected model.

[0075] After step 5, the third-party training sample set Will be divided into two disjoint parts, including a high confidence dataset (containing high confidence samples) and low confidence datasets (containing low confidence samples) In this step, the high confidence dataset is retained Labels, remove low confidence data sets The label is obtained In order to exploit the available information in the poisoned data and reduce its malicious influence on the trained model, w is initialized as Fine-tune w of the entire model through semi-supervised learning. Specifically, the third formula can be used to obtain the corrected model parameters; the third formula is:

[0076]

[0077] Among them, w * are the model parameters after correction; A high confidence dataset representing the retained labels; Represents an unlabeled low-confidence dataset; Represents semi-supervised loss; in this embodiment, the loss function in MixMatch can be used.

[0078] Correspondingly, step 4 is specifically as follows: using the corrected model to perform category prediction on the test data set.

[0079] The method of decoupling the training of the feature extractor and classifier of the design model of the present invention destroys the trigger pattern through the strong data enhancement used in self-supervised learning, making it impossible to be perceived in the representation learning stage, and further disconnects the trigger and the target label by the deconstruction process. Therefore, even if the model is trained on a backdoor-poisoned data set, the backdoor cannot be successfully created. The method proposed by the present invention has strong practical operability, can significantly reduce the success rate of the attack and maintain the accuracy of the model on normal data.

[0080] Another embodiment of the present invention provides a backdoor attack defense system based on training process deconstruction, the system comprising:

[0081] An acquisition module, used to acquire a labeled training sample set containing backdoor poisoned data;

[0082] The training module is used to remove the labels from the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into the neural network model for feature extraction layer training;

[0083] The training module is also used to input the labeled training sample set into the neural network model to perform simple classification layer training to obtain a trained model;

[0084] The testing module is used to use the trained model to make category predictions on the test dataset;

[0085] Furthermore, the training module is also used for:

[0086] Obtaining a training loss value of each sample in the labeled training sample set, and dividing the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold;

[0087] De-labeling the low-confidence data set, and correcting the trained model using the high-confidence data set and the de-labeled low-confidence data set to obtain a corrected model;

[0088] Accordingly, the test module is specifically used for:

[0089] The corrected model is used to perform category prediction on the test data set.

[0090] The functional explanation of each module in the above defense system can refer to the explanation of each step in the defense method, which will not be repeated here.

[0091] The above are only a few embodiments of the present application and do not constitute any form of limitation to the present application. Although the present application is disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technician familiar with the profession, without departing from the scope of the technical solution of the present application, using the technical content disclosed above to make slight changes or modifications are equivalent to equivalent implementation cases and fall within the scope of the technical solution.

Claims

1. A backdoor attack defense method based on training process deconstruction, characterized in that: The method comprises: Step 1: Obtain a labeled training sample set containing backdoor poisoned data; Step 2: De-label the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into the neural network model, and use the self-supervised learning method to train the feature extraction layer; wherein the first formula is used to obtain the feature extraction layer parameters; the first formula is: in, is the feature extraction layer parameter after training; represents the unlabeled training sample set, and x is a sample in the unlabeled training sample set; represents the self-supervised learning loss; Step 3: input the labeled training sample set into the neural network model, and use the supervised learning method to perform simple classification layer training to obtain a trained model; wherein the simple classification layer parameters are obtained using the second formula; the second formula is: in, are the parameters of the simple classification layer after training; represents the labeled training sample set, x and y are the samples and labels in the labeled training sample set respectively; Represents the predicted category of sample x; represents the loss of supervision; Step 4: Use the trained model to perform category prediction on the test data set; After step 3, the method further comprises: Step 5: Obtain the training loss value of each sample in the labeled training sample set, and divide the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold; Step 6: De-label the low-confidence data set, and use the high-confidence data set and the de-labeled low-confidence data set to correct the trained model using a semi-supervised learning method to obtain a corrected model; wherein the third formula is used to obtain the corrected model parameters; the third formula is: Among them, w * are the model parameters after correction; A high confidence dataset representing the retained labels; Represents an unlabeled low-confidence dataset; represents the semi-supervised loss, and w is initialized as Correspondingly, step 4 is specifically as follows: using the corrected model to perform category prediction on the test data set.

2. The method according to claim 1, characterized in that The step 5 specifically includes: Obtaining the training loss value of each sample in the labeled training sample set during the simple classification layer training process; Arrange all samples in order of training loss value from small to large to obtain a loss value sequence; The first α% of the training samples in the loss value sequence that are less than a preset threshold are classified into the high confidence data set, and the remaining (100-α)% of the training samples in the loss value sequence are classified into the low confidence data set; where α is a hyperparameter and α∈[0,100].

3. A backdoor attack defense system based on the backdoor attack defense method based on training process deconstruction according to claim 1 or 2, characterized in that: The system comprises: An acquisition module, used to acquire a labeled training sample set containing backdoor poisoned data; A training module is used to perform a de-labeling process on the labeled training sample set to obtain an unlabeled training sample set, and input the unlabeled training sample set into a neural network model to perform feature extraction layer training; The training module is also used to input the labeled training sample set into the neural network model to perform simple classification layer training to obtain a trained model; A testing module, used to use the trained model to perform category prediction on a test data set; The training module is also used to: Obtaining a training loss value of each sample in the labeled training sample set, and dividing the labeled training sample set into a high-confidence data set and a low-confidence data set according to the training loss value of each sample and a preset threshold; De-labeling the low-confidence data set, and correcting the trained model using the high-confidence data set and the de-labeled low-confidence data set to obtain a corrected model; Accordingly, the test module is specifically used for: The corrected model is used to perform category prediction on the test data set.

Images