Deep learning backdoor defense method based on feature space distance reinforcement

Abstract

The application discloses a deep learning backdoor defense method based on feature space distance reinforcement, and relates to the technical field of artificial intelligence security, and comprises the following steps: quantifying the class distance of a model feature space; designing a backdoor generation method, generating various general triggers, updating a pre-selection matrix U; based on the pre-selection matrix U, designing a scheduler to select the class pair with the largest distance capacity; designing a bidirectional backdoor generation method, generating symmetric backdoor triggers, performing class distance symmetric reinforcement training, and updating a post-selection matrix V; based on the pre-selection matrix U and the post-selection matrix V, designing a reward function to optimize class pair selection; reusing the backdoor, designing dynamic adaptive optimization weight acceleration reinforcement training, and continuously iterating until each group of class pairs reaches the corresponding maximum class distance. The application is simple and easy to implement, helps to improve the backdoor defense effect, takes into account the accuracy and availability of the model, and thus guarantees the safety requirements of actual production.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence security, and more particularly to a deep learning backdoor defense method based on feature space distance reinforcement. BACKGROUND

[0002] Backdoors in deep learning models can cause any input with a specific pattern to be misclassified as the target class. Unlike adversarial examples, which require the generation of perturbations during model execution, backdoor attacks can quickly take effect by simply marking a pattern. Although backdoors can be artificially injected through data poisoning, neuron hijacking, etc., they also exist widely in normally trained models: when the similarity between data classes is too high or the model overfits the underlying features contained in the target class, it can lead to a natural backdoor. With the increasing application of deep learning models in security-critical tasks such as autonomous driving, monitoring, and access control, backdoors are becoming a prominent security threat.

[0003] Existing defense techniques can be divided into backdoor scanning (determining whether a model has an injected backdoor), backdoor detection (determining whether an input contains a backdoor pattern during execution), backdoor elimination (clearing an injected backdoor in a model), etc. These techniques mostly target artificially injected backdoors. For example, backdoor scanning methods usually rely on the assumption of backdoor stealth, i.e., the injected backdoor pattern is usually small; backdoor attack detection techniques need to observe the difference in internal behavior triggered by backdoor inputs and normal inputs; backdoor elimination techniques rely on normal samples to suppress injected backdoors. For backdoors that are not intentionally injected by attackers but are caused by training, data itself (i.e., natural backdoors), the defense effect of existing methods is very limited. For example, natural backdoors can cause backdoor scanning methods to produce false positives for normal models containing natural backdoors; samples using natural backdoors may evade backdoor detection without causing abnormal internal behavior; using normal data cannot completely eliminate natural backdoors caused by data.

[0004] Adversarial training is a widely used model reinforcement method that can force the model to forget the influence of underlying features on the main task. The purpose of adversarial training is to make any input still be correctly classified under the adversarial perturbation of the L p norm, which to some extent expands the class distance. However, since adversarial training is in the L pThe training under the constraint only considers the local disturbance around a single sample, and the defense effect on the backdoor attack is limited; at the same time, the adversarial training can also cause the performance of the model to drop sharply. If the backdoor is directly used for adversarial training, usually high calculation cost and long convergence time are required: the use of the backdoor generated by the direct backdoor scanning in the adversarial training is like applying a large amount of offset to the decision boundary, and the oscillation of the decision boundary makes it difficult for the model to train; since the backdoor can exist between any class pair, the training has a quadratic complexity, and the cost is large.

[0005] Therefore, how to improve the backdoor defense effect while considering the accuracy and usability of the model is a technical problem that those skilled in the art need to solve. SUMMARY

[0006] Therefore, in view of the defects that the adversarial training method is difficult to implement in the backdoor scene, the present application makes full use of the backdoor characteristics in the feature space, and provides a deep learning backdoor defense method based on feature space distance reinforcement strategy symmetric training and dynamic scheduling, which guarantees the effectiveness and simplicity of defense.

[0007] In order to achieve the above purpose, the present application provides the following technical scheme:

[0008] A deep learning backdoor defense method based on feature space distance reinforcement, comprising the following steps:

[0009] Quantify the class distance of the feature space of the model;

[0010] Design a backdoor generation method to generate general triggers for each class, and update the pre-selection matrix U;

[0011] Based on the pre-selection matrix U, design a scheduler to select the class pair with the largest distance capacity;

[0012] Design a bidirectional backdoor generation method to generate symmetric backdoor triggers, perform symmetric reinforcement training on the class distance, and update the post-selection matrix V;

[0013] Based on the pre-selection matrix U and the post-selection matrix V, design a reward function to optimize the selection of the class pair;

[0014] Reuse the backdoor to design a dynamic adaptive optimization weight to accelerate the reinforcement training, and iterate until each group of class pairs reaches the corresponding maximum class distance.

[0015] The technical effects achieved by the above technical scheme are as follows: based on the feature space distance reinforcement strategy, the distance between a pair of classes is defined as the basis for training, the label pair is dynamically scheduled through the use of backdoor pre-selection and training process post-selection information, symmetric reinforcement training is performed based on the scheduler selection result, the class distance is maximized with reasonable training cost to ensure model accuracy and usability, the success rate of backdoor attack is reduced, and the accuracy of detection samples is improved.

[0016] Optionally, the class distance of the quantization model feature space is quantified, specifically:

[0017] The Lp norm of the minimum backdoor conversion required to flip from the victim class to the target class is defined as the distance between the two classes, that is, the class distance is determined by the minimum backdoor.

[0018] Optionally, a backdoor generation method is designed, specifically:

[0019] According to the gradient descent optimization, the backdoor generation method is designed to generate the corresponding reverse trigger; the backdoor generation method is as follows:

[0020]

[0021]

[0022] In the formula: is the loss function of the model ; y t is the target label different from the true label of the input x; λ is the weight of the L 1 norm of the second term m; is the conversion of applying the generated backdoor to the input x; m is a mask matrix whose value ranges from 0 to 1; δ is a backdoor with the same shape and value range as the input x; X represents a sample data set, and x' represents a backdoor poisoned input.

[0023] Optionally, a general trigger for each class is generated, specifically:

[0024] Each class is sequentially regarded as a target class, and a general trigger is generated by the backdoor generation method, so that the labels of all samples except the target class are changed to the target class label;

[0025] The specific generation method of the general trigger is as follows:

[0026]

[0027] In the formula: x' i is obtained by formula (1), y i is the true label of x i , and x i represents each sample of the data set.

[0028] Optionally, the pre-selection matrix U is updated, specifically:

[0029] The general trigger is applied to all source classes except the target class to start the optimization process; in each optimization process of the target class, the loss change of different source classes is recorded, and a set of samples is used for each source class to approximate the distance from the source class to the target class, and the calculation formula is as follows:

[0030]

[0031] In the formula: s and t represent the source class and the target class respectively; u s→t represents the distance from the source class to the target class; m is the number of samples; and represent the initial loss value and the final loss value of sample i respectively; y i,s is the label of sample i, and y t is the label of the target class;

[0032] The calculation result of formula (4) is updated in the pre-selection matrix U each time the optimization is performed, and each item records the change of the loss value from the source class to the target class, the row represents the source class, and the column represents the target class, that is, U[s,t]=u s→t ; constantly repeat, traverse each target class, until each item in the pre-selection matrix U except the diagonal line is filled, and the diagonal line items are initialized using -∞.

[0033] Optionally, a scheduler is designed to select the class pair with the largest distance capacity, that is, to select the class pair with the largest potential for class distance increase through the K-arm scheduler, specifically:

[0034] Suppose the model has N classes, create N×(N-1) / 2 candidate items, each candidate item represents an optimization target of a class pair, and select a pair of most promising targets through the scheduler;

[0035] An ε-greedy algorithm is used to introduce randomness to the scheduler, and the scheduling formula is as follows:

[0036]

[0037] In the formula: P is the selected class pair; W is the reward function of selecting the class pair with the largest potential; ∈ represents the level of randomness; s is a random sample drawn from a uniform distribution on [0,1).

[0038] The above technical solution achieves the technical effect of simplifying the method complexity by designing a scheduler for class pair optimization based on feature space distance changes.

[0039] Optionally, a symmetric backdoor trigger is generated, specifically:

[0040] Based on formula (1) and formula (2), a bidirectional backdoor generation method is designed, and the bidirectional backdoor generation method is used to generate two backdoor triggers for the class pair with the maximum distance capacity, and is pasted on the samples of the corresponding source class, and the loss of two directions is calculated at the same time;

[0041] Check whether each generated backdoor reaches the expected attack success rate and whether it is smaller in size than the previous result, if so, record the best result, and add random disturbance to the backdoor variables m and delta, iterate multiple times to avoid local minimum.

[0042] Optionally, the selection matrix V is updated, specifically including the following steps:

[0043] Using the sample batch pasted with backdoor triggers, a class distance symmetric reinforcement training is designed, and two directions of a class pair are trained at the same time; the model parameters are updated according to the cross entropy loss to eliminate the low-level features of the class;

[0044] The accumulated class distance change and the product of the early change with exponential decay are used to measure the degree of change, and the calculation formula is as follows:

[0045]

[0046] In the formula, q is the number of current iteration; is the L 1 norm of the backdoor mask matrix m from the source class s to the target class t at the i-th iteration, indicating the distance between them;

[0047] The calculation result is updated in the post-selection matrix V using formula (6), and the row represents the source class and the column represents the target class.

[0048] The above technical scheme achieves the technical effect that: by combining bidirectional backdoor generation and symmetric reinforcement training, the usability of the reinforced model is effectively improved, and the stability of the minimum backdoor analysis of the class pair is ensured.

[0049] Optionally, the calculation formula of the reward function W is as follows:

[0050]

[0051] In the formula, the parameter alpha controls the degree of dependence of the scheduler on the information from the pre-selection and training stages; i is the number of training iterations; n is the number of classes.

[0052] The above technical scheme achieves the technical effect that: in the next round of training process, the process of selecting class pairs before each round of training can be better optimized, and the class distance change information in the training process can be fully utilized.

[0053] Optionally, a dynamic adaptive optimization weight is designed to accelerate the reinforcement training, specifically:

[0054] The method reuses the backdoor to generate the current backdoor by using the backdoor generated in the previous training iteration as the initialization of the current backdoor.

[0055] The value of the optimization weight is set, and when no backdoor meeting the condition is found, the optimization weight is dynamically reduced for the next iteration, and the iteration is performed for reinforcement training until each group of class pairs reaches the corresponding maximum class distance.

[0056] The above technical solution achieves the technical effect of accelerating the model reinforcement process by reusing the backdoor and reducing the defense overhead.

[0057] According to the above technical solution, compared with the prior art, the deep learning backdoor defense method based on feature space distance reinforcement provided by the present disclosure has the following beneficial effects:

[0058] (1) The present disclosure is based on the feature space distance reinforcement strategy, defines the distance between a pair of classes as the basis for training, dynamically schedules the labels by using the general backdoor pre-selection and the training process post-selection information, performs symmetric reinforcement training based on the scheduler selection result, maximizes the class distance with reasonable training cost to ensure the model accuracy and usability, reduces the success rate of backdoor attacks, and improves the accuracy of the detection sample. Ultimately, it can be applied to actual industrial production sites to ensure safe and reliable operation of production and high-quality pursuit of products;

[0059] (2) The present disclosure designs a scheduler for optimizing class pairs based on the change of the feature space distance, simplifies the method complexity, and accelerates the model reinforcement process by reusing the backdoor to reduce the defense overhead. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present disclosure, and those skilled in the art can obtain other drawings according to the provided drawings without creative labor.

[0061] Figure 1 It is a general flowchart of the deep learning backdoor defense method based on feature space distance reinforcement.

[0062] Figures 2(a)-2(c) It is a feature space and decision boundary diagram under normal training, adversarial training and the training method of the present disclosure, respectively. DETAILED DESCRIPTION

[0063] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort are within the protection scope of the present application.

[0064] The application discloses a deep learning backdoor defense method based on feature space distance reinforcement, comprising the following steps:

[0065] Quantifying the class distance of the feature space of the model; designing a backdoor generation method to generate various general triggers, updating the pre-selection matrix U; based on the pre-selection matrix U, designing a scheduler to select the class pair with the largest distance capacity; designing a bidirectional backdoor generation method to generate symmetric backdoor triggers, performing symmetric reinforcement training on the class distance, and updating the post-selection matrix V; based on the pre-selection matrix U and the post-selection matrix V, designing a reward function to optimize the class pair selection; reusing the backdoor to design a dynamic adaptive optimization weight to accelerate the reinforcement training, and continuously iterating until each group of class pairs reaches the corresponding maximum class distance.

[0066] Based on the above steps, it can be understood that the present application fully considers the attack methods and attack characteristics that may be adopted by different attackers, and the defense by the method realizes the maximization of the feature space distance with small training cost, and the deep learning model obtained by training is more secure and reliable, and has good defense effect on various advanced backdoor attack methods (including naturally existing backdoors), and improves the accuracy of the detection samples. The method provided by the present application can realize the process by computer software technology, Figure 1 The total process of the defense scheme is as follows, the present application will be further described in combination with the accompanying drawings and specific examples, and the principles and implementation details of each step are as follows:

[0067] 1. Quantifying the class distance of the feature space of the model

[0068] The distance between two classes of samples of a deep learning classifier can be measured by the difficulty of changing all or most of the labels of one class to the labels of another class. In this embodiment, L p The norm is the distance between two classes, that is, the class distance is determined by the minimum backdoor.

[0069] The class distance definition proposed in this embodiment differs from the existing class distance concept in the following two aspects: (1) Based on a set of samples, the distance from the sample center to the decision boundary is measured, as shown in Figure 2(c). The points on both sides of the black line in the figure represent two classes of samples, and the black line represents the standard decision boundary that separates the two classes of samples. The solid arrows in Figure 2(a) and Figure 2(c) indicate the backdoor transformation required to flip a set of samples to the other side of the decision boundary. The curves in Figure 2(b) and Figure 2(c) respectively represent the decision boundaries after adversarial training and the training method of this invention. In the existing scheme, each sample is measured to obtain the shortest distance between the sample and the decision boundary. The concept of class distance is essentially related to the underlying trigger inverse method, which is modular, meaning that any suitable inverse method can be used to measure class distance. (2) The class distance proposed in this embodiment does not measure the robustness of the model under adversarial attacks on specific inputs. Since the class distance does not consider the minimum distance of each sample, the hardened model cannot defend against adversarial attacks. As shown in Figure 2(c), there are points of different classes close to the decision boundary (after hardening), so the model may still be vulnerable to traditional adversarial attacks. This invention believes that these two methods complement each other.

[0070] 2. Obtain the pre-selection matrix U. This step is achieved through the following sub-steps:

[0071] (2.1) Design of backdoor generation method: Based on gradient descent optimization, a backdoor generation method is designed to generate the corresponding inverse trigger; the backdoor generation method is as follows:

[0072]

[0073]

[0074] In the formula: It is a model The loss function; y t It is the target label, which is different from the true label of the input x; λ is the L value adjusted by the second term m. 1 The weight of the norm; The generated backdoor is applied to the transformation of input x; m is a mask matrix with values ​​ranging from 0 to 1; v is a backdoor with the same shape and value range as input x; X represents the sample dataset, and x' represents the backdoor poisoning input.

[0075] (2.2) Generate various general triggers: Treat each class as the target class in turn, and use the backdoor generation method designed in step 2.1 to generate general triggers so that the labels of all other samples except the target class are changed to the target class labels;

[0076] The specific method for generating a general trigger is as follows:

[0077]

[0078] where x i is the true label of x i , x i represents each sample in the dataset. i

[0079] A more direct idea is to generate specific triggers for each class separately, however, this method has quadratic complexity and is too costly. Therefore, an approximate method is designed in this embodiment, which generates general triggers to reduce the complexity to linear and greatly reduce the cost under the premise of ensuring availability.

[0080] (2.3) Update the pre-selection matrix U: apply general triggers to all source classes except the target class to start the optimization process; in each optimization process of the target class, in order to measure the difficulty of changing the sample label of one class to the target class label, record the loss changes of different source classes. The classes different from the target class will have a large initial loss value due to the difference between them and the target class, and once the prediction of all samples is successfully changed to the target class label, the loss value of all classes is small.

[0081] This embodiment uses a set of samples for each source class to approximate their distance to the target class, and the calculation formula is as follows:

[0082]

[0083] where s and t represent the source class and the target class respectively; u s→t represents the distance from the source class to the target class; m is the number of samples; and represent the initial loss value and the final loss value of sample i respectively; y i,s is the label of sample i, and y t is the label of the target class;

[0084] Each optimization updates the calculation result of formula (4) in the pre-selection matrix U, and each item records the change of the loss value from the source class to the target class, the row represents the source class, and the column represents the target class, that is, U[s,t] = u s→t ; repeat step 2.3 to traverse each target class until each item in the pre-selection matrix U except the diagonal line is filled, and the diagonal line items are initialized with -∞.

[0085] ​3、Design scheduler to select the class pair with the largest distance capacity: After obtaining the pre-selection matrix U in step 2, it is necessary to select the class pair with the largest distance capacity (i.e. the most difficult to change its label) according to the loss change information in the matrix U to optimize the cost-effectiveness. This embodiment designs a K-arm scheduler to select the class pair with the largest potential for increasing the class distance, specifically:

[0086] Suppose the model has N classes, create N x (N-1) / 2 candidate options (i.e. all undirected pair combinations), each candidate option represents an optimization target for a class pair, and select the most promising target through the scheduler. Since only a batch of samples guides the selection at each iteration, and the local distance may not be the same as the global distance, leading to uncertainty in target selection, therefore, this embodiment uses an ε-greedy algorithm to introduce randomness to the scheduler. Specifically, a random sample is drawn from a uniform distribution on [0,1), if the random sample is greater than the threshold ε, select based on the objective function; otherwise, select a random candidate (class pair). The scheduling formula is as follows:

[0087]

[0088] In the formula: P is the selected class pair; W is the reward function for selecting the most potential class pair; ε represents the level of randomness; s is a random sample drawn from a uniform distribution on [0,1).

[0089] With this ε-greedy algorithm, if a class pair is promising globally but not locally, it can still be selected with a probability of ε in the next iteration even if it was not successfully selected earlier.

[0090] 4、Symmetric reinforcement training of class distance, which is realized by the following sub-steps:

[0091] (4.1) Generate symmetric backdoor triggers: After obtaining the class pair with the largest distance capacity according to step 3, based on formula (1) and formula (2), this embodiment designs a bidirectional backdoor generation method, which simultaneously generates two backdoor triggers for the class pair and attaches them to the samples of the corresponding source class, while calculating the loss in both directions. The bidirectional backdoor generation method reduces the training cost required to run the existing backdoor generation method twice to generate backdoors respectively by half, reducing the oscillation that may occur during training.

[0092] For each generated backdoor, check whether it reaches the expected attack success rate and whether it has a smaller size than the previous result, if so, record the best result, and add random perturbations to the backdoor variables m and δ, iterate multiple times to avoid local minimum.

[0093] (4.2) Training model: With the sample batch pasted with backdoor triggers, this embodiment designs a new kind of distance pair symmetry reinforcement training, which trains two directions of a class pair at the same time; according to the cross-entropy loss to update the model parameters, which essentially eliminates the low-level features of the class, and forces the model to learn more high-level semantic features to distinguish the class pair, avoiding the model overfitting on the low-level features.

[0094] The application of symmetric backdoor training method solves the oscillation problem of asymmetric (i.e. one class pair generates only one single direction backdoor) training. As shown in Fig. 2(c), the purpose of the reinforcement process is to push the decision boundary to the opposite side of each class pair, if only one direction is reinforced each time, the decision boundary will tilt to one side, after several rounds of back and forth pushing, the oscillation phenomenon is caused, which cannot meet the expected goal well.

[0095] (4.3) Update the post-selection matrix V: record the change of class distance between each class pair in each training process, and update it in the post-selection matrix V. Some class pairs have a large class distance increment in several iterations, the goal of this step is to prioritize these class pairs according to the distance increment, and based on the ranking, select a class pair with the largest class distance increment between two iterations. In order to reduce the difference between iterations and enhance the stability of the scheduler, this embodiment considers using the product of the cumulative class distance change and the exponentially decaying early change to measure the degree of change, the calculation formula is as follows:

[0096]

[0097] In the formula: q is the number of the current iteration; is the L 1 norm of the backdoor mask matrix m from the source class s to the target class t at the i-th iteration, which represents the distance between them; this scheme uses the size of the general backdoor in the pre-selection stage as the initialization of

[0098] Update the calculation result in the post-selection matrix V using formula (6). The meaning of each item in the matrix is similar to that of the pre-selection matrix U, where the row represents the source class and the column represents the target class, such as V[0,1] represents the cumulative class distance change from class 0 to class 1.

[0099] 5. Designing a reward function to optimize the selection of class pairs: In order to better optimize the process of selecting class pairs before each round of training, and make full use of the information of the change of class distance during the training process, according to the obtained matrices U and V, this embodiment designs a reward function W, which is a combination of two components: the pre-selection matrix U and the post-selection matrix V. As mentioned earlier, the pre-selection matrix U stores the loss change in the pre-selection stage using the general trigger, and the post-selection matrix V monitors and records the change of class distance of each class pair during the training process. In the early stage of training, since many class pairs have not been explored, this scheme relies more on the pre-selection matrix U as a guide for selecting class pairs; as the number of training iterations increases, more class pairs are explored, and their distance changes in V represent their priority for selection, so the reward function W takes into account the information of both the pre-selection matrix U and the post-selection matrix V, and the specific calculation formula is as follows:

[0100]

[0101] In the formula: the parameter a controls the degree of dependence of the scheduler on information from the pre-selection and training stages; i is the number of training iterations; and n is the number of classes. Since the pre-selection stage has undergone n iterations, this scheme excludes these iterations in the reward function.

[0102] 6. Reusing backdoors to design dynamically adaptive optimization weights to accelerate and reinforce training: Since the minimum symmetric backdoor needs to be generated in each iteration process in step 5, the common practice is to start from a randomly initialized m and δ each time, but this requires a very high training cost. This embodiment uses the method of reusing backdoors, which uses the backdoor generated in the previous training iteration process as the initialization of the current backdoor, so that it has a much higher attack success rate than random initialization, thereby quickly focusing the optimization on reducing the size of the backdoor and reducing the cost of backdoor generation.

[0103] Since the first term in formula (1) is easier to satisfy the backdoor reuse, this embodiment increases the optimization weight λ in the second term. Set λ = 0.001 to generate the initial backdoor, and set λ = 0.2 for subsequent backdoors. If no backdoor that meets the conditions is found, then dynamically reduce the optimization weight λ for the next iteration. Iteration steps 3 to 6 perform reinforcement training until each group of class pairs reaches its maximum class distance.

[0104] In addition, using the defense method of the present application, this embodiment also performs ablation experiments to further illustrate the superiority of each design step. The specific content is as follows:

[0105] The original model is trained on the same data set using the normal training method, the training method of the application, and the training method of the application after removing symmetric reinforcement, backdoor reuse, weight dynamic adjustment, pre-selection stage, and K-arm scheduler design respectively, and the training performance results are recorded. Five experimental indicators are used in this experiment to reflect the defense effect and usability, namely the prediction accuracy of benign input, training time, class distance, class distance improvement ratio, and accuracy reduction ratio. The final experimental data is shown in Table 1:

[0106] Table 1 Experimental data obtained by using different training methods

[0107]

[0108] The experimental data shows that the overall defense performance improvement decreases by 30% after removing symmetric reinforcement training, which reflects its importance; without symmetric reinforcement, the training time will also increase due to the need to consider two directions of a class pair, which is consistent with the discussion in step 4.1. Removing backdoor reuse and weight dynamic adjustment increases the training time by 51%, and the improvement of class distance is reduced by 10%, indicating that the backdoor reuse process improves the overall performance. Removing the pre-selection stage greatly increases the training cost by 75%, which may be worse in tasks with more classes. Removing the K-arm scheduler greatly increases the training cost (accelerates nearly 4 times), while the feature space class distance improves the performance similar to that with the scheduler, which strongly proves the excellent effect of the scheduler in reducing the training cost.

[0109] In summary, the model reinforcement method proposed by the application can be directly attached to various models for training to improve the defense effect against backdoor attacks. The reinforcement strategy based on feature space distance adopts symmetric training to reduce oscillation, dynamic scheduling to reduce time complexity, and reuse of backdoors to improve efficiency, etc. optimization methods, which maximize the class distance with reasonable training cost to ensure model accuracy and usability, reduce the success rate of backdoor attacks, and improve the accuracy of detection samples, can be applied to reduce false positives, enhance backdoor elimination, etc. scene.

[0110] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. The above description of the disclosed embodiments enables a person skilled in the art to implement or use the application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A deep learning-based backdoor defense method based on feature spatial distance reinforcement, characterized in that, Includes the following steps: Quantize the class distance in the feature space of the model; Design a backdoor generation method to generate various general triggers and update the pre-selection matrix U; Based on the pre-selection matrix U, a scheduler is designed to select the class pair with the largest distance capacity. Design a bidirectional backdoor generation method to generate a symmetric backdoor trigger, perform distance-based symmetric reinforcement training, and update the selection matrix V; Based on the pre-selection matrix U and the post-selection matrix V, a reward function is designed to optimize the selection of class pairs; Reuse the backdoor, design dynamically adaptive and optimized weights to accelerate and strengthen training, and iterate continuously until each class pair reaches the corresponding maximum class distance.

2. The deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, The class distance in the feature space of the quantized model is specifically as follows: Define L as the minimum backdoor transformation required to flip from the victim class to the target class. p The norm is the distance between two classes, meaning the class distance is determined by the minimum backdoor.

3. The deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, The backdoor generation method is designed as follows: The backdoor generation method is designed based on gradient descent optimization, and a corresponding inverse trigger is generated; the backdoor generation method is as follows: In the formula: It is a model The loss function; y t It is a target label that is different from the true label of the input x; λ is the L that adjusts the second term m. 1 The weight of the norm; This involves applying the generated backdoor to the transformation of input x; m is a mask matrix whose values ​​range from 0 to 1; δ is a backdoor with the same shape and range of values ​​as the input x; X represents the sample dataset, and x' represents the backdoor poisoning input.

4. The deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 3, characterized in that, Generate various general-purpose triggers, specifically: Each class is treated as a target class in turn, and a general trigger is generated through the backdoor generation method to change the labels of all other samples except the target class to the target class labels; The specific method for generating a general trigger is as follows: In the formula: x' i y is obtained through formula (1). i It is x i The real label, x i This represents each sample in the dataset.

5. The deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, Update the preselection matrix U as follows: Apply the generic trigger to all source classes except the target class to initiate the optimization process; During each optimization of the target class, the loss changes for different source classes are recorded. For each source class, a set of samples is used to approximate the distance from the source class to the target class. The calculation formula is as follows: In the formula: s and t represent the source class and target class, respectively; u s→t This represents the distance from the source class to the target class; m is the number of samples. and y represents the initial and final loss values ​​for sample i, respectively; i,s The label is for sample i, y t It is a tag for the target class; Each optimization update updates the pre-selection matrix U with the calculation result of formula (4). Each item records the change in loss value from the source class to the target class. The row represents the source class and the column represents the target class, i.e., U[s,t]=u s→t Repeat this process, iterating through each target class until every item in the preselection matrix U, except for the diagonal items, is filled, with the diagonal items initialized with -∞.

6. The deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, The scheduler is designed to select class pairs with the largest distance capacity, i.e., to filter class pairs with the greatest potential for increasing class distance using a K-arm scheduler. Specifically: Suppose the model has N classes, create N×(N-1) / 2 candidate options, each candidate option represents the optimization objective of a class pair, and select the most promising pair of objectives through the scheduler; The ∈-greedy algorithm is used to introduce randomness into the scheduling process, and the scheduling formula is as follows: In the formula: P is the selected class pair; W is the reward function for selecting the most promising class pair; ∈ represents the level of randomness; s is a random sample drawn from a uniform distribution on [0,1).

7. A deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 3, characterized in that, The symmetric backdoor trigger is generated as follows: Based on formulas (1) and (2), a bidirectional backdoor generation method is designed. The bidirectional backdoor generation method is used to symmetrically generate two backdoor triggers for the class pair with the largest distance capacity and attach them to the samples of the corresponding source class. At the same time, the loss in both directions is calculated. Check whether each generated backdoor achieves the expected attack success rate and whether it has a smaller size than the previous results. If so, record the best result and add random perturbations to the backdoor variables m and δ. Iterate multiple times to avoid local minima.

8. A deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 7, characterized in that, After updating, select matrix V, specifically including the following steps: Using a batch of samples with backdoor triggers applied, a class distance symmetric reinforcement training method is designed to train both directions of a class pair simultaneously; the model parameters are updated based on cross-entropy loss to eliminate low-level features of the class. The degree of change is measured by the product of the cumulative class distance change and the exponentially decaying early change, calculated as follows: In the formula: q is the current iteration number; It is the L-axis of the backdoor mask matrix m from the source class s to the target class t in the i-th iteration. 1 Norms, representing the distance between them; The calculation results are updated in the post-selection matrix V using formula (6), where rows represent source classes and columns represent target classes.

9. A deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, The formula for calculating the reward function W is as follows: In the formula: parameter α controls the degree to which the scheduler depends on information from the pre-selection and training phases; i is the number of training iterations; n is the number of classes.

10. A deep learning-based backdoor defense method based on feature spatial distance reinforcement according to claim 1, characterized in that, The design incorporates dynamically adaptive weight optimization to accelerate and strengthen training, specifically as follows: The method of reusing backdoors is adopted, which uses the backdoors generated during previous training iterations as the initialization for generating the current backdoor; Set the value of the optimization weight. When no backdoor that meets the conditions is found, the optimization weight is dynamically reduced to proceed to the next iteration. The iteration is used to strengthen the training until each class pair reaches the corresponding maximum class distance.

Images