A backdoor attack method, device, and medium based on spatial transformation

Abstract

This invention discloses a backdoor attack method, apparatus, and medium based on spatial transformation. The method includes: randomly selecting a portion of image samples from the original dataset and performing a spatial transformation with set parameters, changing the label of the portion of image samples to the target label, and performing a spatial transformation with random parameters on the remaining benign image samples in the original dataset while keeping the labels unchanged, thereby processing the original dataset into a poisoned dataset; using the poisoned dataset for standard training of a deep learning classification model to construct a victim model with a hidden backdoor implanted; wherein, when the victim model performs classification prediction, its hidden backdoor can be activated by samples in the dataset to be classified that have undergone the spatial transformation with set parameters, causing the samples in the dataset to be classified that have undergone the spatial transformation with set parameters to be incorrectly predicted as the target label, while the remaining samples can be correctly predicted as the true label.

Description

Technical Field

[0001] This invention relates to the fields of computer vision and artificial intelligence, and in particular to a backdoor attack method, apparatus and related computer storage medium based on spatial transformation. Background Technology

[0002] Deep neural networks have been widely applied in computer vision, such as image detection, facial recognition, and autonomous driving. Their success largely depends on large amounts of training data and powerful computing capabilities. However, not all researchers or developers have the ability to create their own datasets or possess the necessary computing resources. To reduce costs, users often use third-party resources, such as datasets provided by certain companies or institutions, or outsource their training process to third-party computing platforms. When using these resources, the model's training and inference processes are not entirely transparent to the user, thus introducing security vulnerabilities such as data poisoning, adversarial attacks, and backdoor attacks. Adversarial attacks explore the vulnerabilities of deep neural networks during the inference phase. However, compared to the inference phase, the training phase is more complex and involves a wider range of aspects, including data collection, data preprocessing, model selection and construction, training, model storage, and model deployment. More steps mean more opportunities for attack and greater security threats. Therefore, backdoor attacks, a security vulnerability occurring during the model training phase, have gradually attracted the attention of the academic community.

[0003] Backdoor attacks are a type of attack targeting deep learning models. Attackers implant backdoors into the model during training. When the backdoor is not activated, the attacked model behaves similarly to a normal model; however, when the backdoor is activated, the model's output changes to a pre-specified target label to achieve malicious purposes. Backdoor attacks can occur in many scenarios where the training process is not fully controlled, such as using third-party datasets, training on third-party platforms, or directly calling third-party models, thus posing a significant threat to model security.

[0004] Backdoor attackers typically have three main objectives: effectiveness, stealth, and robustness. Effectiveness refers to the fact that when a test image contains a backdoor trigger, the attacked deep learning network predicts the target label, and the network's prediction performance for benign samples (without triggers) is not significantly reduced. Stealth refers to the fact that the backdoor trigger used is relatively concealed, not easily detected by the user, and can still achieve a relatively high attack success rate even when the proportion of poisoned samples (i.e., the sample poisoning rate) is small. Robustness refers to the fact that the backdoor attack remains effective against some common backdoor defenses.

[0005] Most common backdoor attacks involve adding extra triggers to the original image, such as pixel blocks, additive noise, or physical objects. The paper "Badnets: Evaluating backdooring attacks on deep neural networks" by Tianyu Gu, Kang Liu, et al. is considered a pioneering work in the field of backdoor attacks. In this paper, a 3×3 white pixel block in the lower right corner of an image is used as a backdoor trigger, pasted onto a benign image, and its label is modified to achieve data poisoning. This is referred to as "Method 1" in this paper.

[0006] The paper "Targeted backdoor attacks on deep learning systems using data poisoning" by Xinyun Chen, Chang Liu, and others first explored the visibility of backdoor triggers and stated their significant impact on the stealth of backdoor attacks. Specifically, to better deceive users, the poisoned image should be indistinguishable from a benign image. This method uses a hybrid strategy to construct an "invisible" attack, adjusting the transparency to better blend the backdoor trigger with the benign image. This is referred to as "Method 2" in this paper.

[0007] The "Invisible backdoor attack with sample-specific triggers" proposed by Yuezun Li, Baoyuan Wu, and others draws inspiration from image steganography. It uses a pre-trained encoder to transform a representative string of the target label into invisible additional noise, which is then embedded into the image as a trigger. Simultaneously, it minimizes the perceptual difference between the input and encoded images. This generates a sample-specific trigger, breaking the fundamental assumption that existing backdoor defense triggers are sample-agnostic. Therefore, it can easily bypass most defenses and has achieved considerable success. This method is referred to as "Method 3" in this paper.

[0008] However, all three existing backdoor attack methods mentioned above require the introduction of additional triggers into the original image to complete the data poisoning. Furthermore, most existing backdoor attacks are applied in digital scenarios and do not closely resemble the real physical world. Summary of the Invention

[0009] To address the shortcomings of existing technologies, this invention proposes a backdoor attack method based on spatial transformation, which solves the problem that existing backdoor attacks require the introduction of additional triggers and are not close enough to the real physical world.

[0010] To solve the above problems, the present invention proposes the following technical solution:

[0011] A backdoor attack method based on spatial transformation includes: randomly selecting a portion of image samples from the original dataset and performing spatial transformation with set parameters, changing the label of the portion of image samples to the target label, and performing spatial transformation with random parameters on the remaining benign image samples in the original dataset while keeping the labels unchanged, thereby processing the original dataset into a poisoned dataset; using the poisoned dataset for standard training of a deep learning classification model to construct a victim model with a hidden backdoor implanted; wherein, when the victim model performs classification prediction, its hidden backdoor can be activated by samples in the dataset to be classified that have undergone spatial transformation with set parameters, causing the samples in the dataset to be classified that have undergone spatial transformation with set parameters to be incorrectly predicted as the target label, while the remaining samples can be correctly predicted as the true label.

[0012] Furthermore, the spatial transformation includes rotation or translation.

[0013] Furthermore, the spatial transformation of the set parameters includes rotating by a set angle or translating by a set distance; the spatial transformation of the random parameters includes rotating by a random angle or translating by a random distance.

[0014] Furthermore, the random rotation angle is a random rotation within an angle range not including the set angle; the random translation distance is a random translation within a distance range not including the set distance.

[0015] To address the aforementioned problems, this invention also proposes a backdoor attack device based on spatial transformation, comprising: a poisoned image generator, used to perform spatial transformation with set parameters on a portion of image samples randomly selected from the original dataset, and change the label of the portion of image samples to the target label, thereby obtaining a poisoned subset; a benign sample processor, used to perform spatial transformation with random parameters on the remaining benign image samples in the original dataset, while keeping the labels unchanged, thereby obtaining a benign subset; and a standard training module, used to perform standard training of a deep learning classification model using the poisoned dataset composed of the poisoned subset and the benign subset, constructing a victim model with a hidden backdoor implanted, such that the victim model has the following characteristics: when the victim model performs classification prediction, its hidden backdoor can be activated by samples in the dataset to be classified that have undergone spatial transformation with the set parameters, causing the samples in the dataset to be classified that have undergone spatial transformation with the set parameters to be incorrectly predicted as the target label, while the remaining samples can be correctly predicted as the true label.

[0016] To address the aforementioned problems, the present invention also proposes a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can implement the steps of the aforementioned backdoor attack method based on spatial transformation.

[0017] The beneficial effects of this invention are as follows: The backdoor attack method based on spatial transformation proposed in this invention does not require the introduction of additional backdoor triggers. It uses the spatial transformations that exist in the physical world itself as backdoor triggers, directly performing spatial transformations on the original samples to create poisoned data. At the same time, it also performs spatial transformations on the remaining benign samples in the original dataset with random parameters while keeping the labels unchanged, to encourage that only spatial transformations with parameters set by the attacker can activate the backdoor hidden in the victim model. Backdoor attacks performed in this way are covert and efficient. They are covert because the spatial transformations of the image naturally exist, thus avoiding user inspection. They are efficient because they do not require the introduction of additional backdoor triggers, but can be obtained by directly processing the original samples, and can naturally bypass many backdoor defenses, greatly enhancing the threat of backdoor attacks and making new explorations in the field of artificial intelligence security. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the backdoor attack method based on spatial transformation according to an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram of the process for creating a poisoning dataset according to an embodiment of the present invention.

[0020] Figure 3 This is a graph showing the influence of different rotation angles as backdoor triggers on the attack effect in an embodiment of the present invention.

[0021] Figure 4 This is a graph showing the changes in the indicators of how different translation distances used as backdoor triggers affect the attack effect in embodiments of the present invention.

[0022] Figure 5 It is a backdoor trigger synthesized using the Neural Cleanse method.

[0023] Figure 6 Grad-CAM is obtained by poisoning samples using three different methods (Method 1, this invention I, and this invention II).

[0024] Figure 7 This is a diagram illustrating the resistance of backdoor attacks to the fine-tuning defense method according to an embodiment of the present invention.

[0025] Figure 8 This is a diagram illustrating the resistance of the backdoor attack proposed in this invention to the pruning defense method.

[0026] Figure 9 These are predictions based on actual traffic sign footage. Detailed Implementation

[0027] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0028] Research shows that backdoor attacks are highly susceptible to spatial transformations (such as flipping and shrinking), as these transformations alter the position or appearance of triggers in the poisoned image. Different backdoor triggers during training and testing reduce the success rate of backdoor attacks. This explains the limited impact of existing backdoor attacks on the real physical world. In real-world image capture and usage, changes in distance and angle between the camera and target object inevitably introduce spatial transformations, altering the backdoor triggers and causing the backdoor attack to fail. This invention leverages this vulnerability, abandoning the current approach of introducing additional backdoor triggers. Instead, it directly uses spatial transformations as the backdoor trigger to design a more effective and less noticeable backdoor, since spatial transformations are ubiquitous in the physical world.

[0029] In view of this, this invention proposes a backdoor attack method based on spatial transformation, the process of which is as follows: Figure 1 As shown, it is mainly divided into three stages: attack, training, and testing.

[0030] The attack phase primarily involves creating the poisoned dataset, referencing... Figure 2 Specifically, this involves: randomly selecting a subset of image samples (Ds) from an original dataset Do, performing a spatial transformation with set parameters, and changing the labels of these image samples Ds to the target labels to obtain a poisoned subset Dm; furthermore, performing a spatial transformation with random parameters on the remaining benign image samples (Do-Ds) in the original dataset while keeping their labels unchanged to obtain a benign subset Dt. In this way, the original dataset Do is transformed into a poisoned dataset Dp, satisfying:

[0031]

[0032] The proportion of randomly selected image samples used for spatial transformation with set parameters relative to the original dataset is called the sample poisoning rate. The value of the sample poisoning rate is set according to actual needs, and this invention does not impose any restrictions on it. However, in practice, a larger value means a larger proportion of poisoned samples, a greater number of poisoned samples, and easier detection by users. Therefore, the sample poisoning rate should not be too large in practice.

[0033] Unlike existing methods that generate poisoned images by directly adding or changing pixels, this invention uses spatial transformations with set parameters that may occur in the physical world to generate poisoned samples. This invention primarily considers two classic spatial transformations: rotation and translation. When performing a spatial transformation with set parameters, a rotation of a set angle or a translation of a set distance is chosen. For example, a selected sample is rotated by 16°, and the remaining samples are rotated by random angles. These random angles can be selected from an angle range that does not contain the set angle of 16°, for example, randomly selecting angles within the range of [-10°, 10°] for transformation.

[0034] The training phase primarily utilizes the aforementioned poisoned dataset for standard training of the deep learning classification model, constructing a victim model with a hidden backdoor implanted. The standard training process includes: neural network initialization, forward propagation to obtain prediction values, calculation of the loss function and backpropagation error, loading the optimizer and optimizing parameters; the learning rate is set to 0.01, and the batch size and number of epochs are set to 128 and 30, respectively. The loss function used is the cross-entropy loss formula, commonly used in classification problems:

[0035]

[0036] Where x is a vector with dimension equal to the number of categories, and each value is the probability value of a different category; class is the index value of the label category. Stochastic Gradient Descent (SGD) is used as the optimizer to optimize the model parameters based on the gradient information until the number of iterations is completed.

[0037] During the testing phase, users use the trained victim model to classify and predict the test dataset. Images in the test dataset that have undergone spatial transformation with set parameters will activate a hidden backdoor in the victim model, causing the model's prediction to mislead the target label. Meanwhile, samples that undergo spatial transformation with other random parameters will still be correctly predicted as their original true labels.

[0038] The backdoor attack method based on spatial transformation proposed in this embodiment of the invention may be implemented under the following conditions:

[0039] Software system: Linux Ubuntu 18.04.3LTS;

[0040] Programming language: Python 3.8;

[0041] Deep learning framework: PyTorch 1.8.0;

[0042] Attack scenario: Scenario 1 - The user uses a third-party dataset.

[0043] There are three real-world scenarios that can generate backdoor attack threats. Each scenario corresponds to different capabilities and permissions for attackers and defenders. Since this invention only concerns attack issues, it only describes the capabilities and permissions of different attackers in these three scenarios. ① Scenario 1: The user uses a third-party dataset. In this scenario, the attacker provides the user with a poisoned dataset directly or via the network. The user will use the contaminated dataset to train and deploy their model. Therefore, the attacker can only manipulate the dataset, not modify the model, training process, or inference process. ② Scenario 2: The user uses a third-party training platform. In this scenario, the user provides their benign dataset, model structure, and training process to an untrusted third-party platform, borrowing their computing resources to train their model. The attacker (i.e., the malicious platform) performs some tampering and contamination (poisoning) during the actual training process, but the attacker does not change the model structure; otherwise, it would be extremely easy to attract the user's attention. ③ Scenario 3: The user uses a third-party model. In this scenario, the attacker obtains a pre-trained model through an Application Programming Interface (API) downloaded from the network and uses it for their inference. In this case, the attacker can change everything except the inference process. In the three attack scenarios described above, the attackers' capabilities gradually increase, and they can modify more and more experimental procedures, making their occurrence in the real world increasingly less likely. This invention applies to the first scenario, which is most likely to occur in actual deployments: a backdoor attacker has access to and can modify the training dataset, but has no way to control the training and inference processes, nor does he / she know other important information about the process, such as the model structure and training loss function.

[0044] The effectiveness of the backdoor attack method based on spatial transformation in this invention will be verified by a specific example below.

[0045] (1) Experimental dataset and experimental model

[0046] All experiments in this invention embodiment are based on the ResNet-18 network and conducted on the GTSRB dataset. This dataset contains 43 categories of common traffic signs, with 39,209 training images and 12,630 test images, which feature different lighting conditions and diverse backgrounds.

[0047] (2) Basic experimental setup

[0048] In this experiment, the poisoning rate of all samples was set to 5%, and the target label was set to "1". When rotation was used as a spatial transformation method, the spatial transformation parameter used by the poisoner was a counterclockwise rotation of 16°, and the angle of the spatial transformation parameter was selected from the range of [-10°, 10°] (this case is referred to as "Invention I" and will not be repeated below). When translation was used as a spatial transformation, the spatial transformation parameter used by the poisoner was a rightward translation of 6 pixels, and the translation distance of the spatial transformation parameter was selected from the range of [-3, 3] (pixels) (this case is referred to as "Invention II" and will not be repeated below). In the experiment, the Attack Success Rate (ASR) and Benign Accuracy (BA) were used to evaluate the effectiveness of the method. The Attack Success Rate refers to the proportion of poisoned samples predicted as the target label by the victim model, and the Benign Accuracy refers to the prediction accuracy of benign samples in the poisoned dataset. The higher the ASR and BA, the better the attack effect of the method.

[0049] (3) Verification of the feasibility and effectiveness of backdoor attacks based on spatial transformation

[0050] Table 1. Effects of different backdoor attack methods

[0051]

[0052] In Table 1, CA refers to the prediction accuracy on a normal dataset without poisoning. "Method 4" is the backdoor attack method from the paper "Backdoor attack in the physical world" proposed by Liming Li, Tongqing Zhai et al. According to the experimental results in Table 1, similar to other classic backdoor attack methods, the two spatial transformations proposed in this invention (Invention I and Invention II) only decreased the prediction accuracy by 0.19% (97.51-97.32=0.19) and 0.74% (97.51-96.77=0.74) respectively compared to benign samples (normal samples without poisoning) without triggers, achieving a very good attack effect. Generally, if poisoning occurs, BA will definitely decrease relative to CA. However, the purpose of a backdoor attack is to predict incorrectly on poisoned samples while maintaining the original prediction for benign samples. That is, if BA decreases less relative to CA, the performance is better. Here, the decrease in the two methods used in the experiment of this invention is controlled within 1%, indicating that the backdoor attack is very effective.

[0053] (4) The influence of spatial transformation parameters on the results

[0054] To further demonstrate the effectiveness of spatial transformation as a backdoor trigger, embodiments of the present invention also discuss whether setting different spatial transformation scales (i.e., rotation angles or translation distances) can maintain high performance. For example... Figure 3 and Figure 4 As shown, it can be seen that as long as the rotation angle is ≥0 or the translation distance is ≥0, the backdoor attack is effective. This indicates that the backdoor attack method based on spatial transformation proposed in this invention achieves good attack performance at almost any specified spatial transformation scale. However, when the transformation scale (rotation angle or translation distance) is too small, rotation and translation are difficult for the neural network to recognize, and poisoned samples will be identified as outliers, resulting in a relatively low benign accuracy and attack success rate. However, a certain proportion of samples are still successfully attacked.

[0055] (5) The impact of different target labels

[0056] Table 2. The impact of different target labels on attack effectiveness

[0057]

[0058] This invention also further explores the setting of target labels in the experimental setup to verify that the backdoor trigger of this invention is still effective when using different target labels. In order to ensure that the proportion of poisoned samples to samples with the same sample poisoning rate is as small as possible, the "1", "2", and "12" categories (labels) with the most categories in the GTSRB dataset are selected for discussion, as shown in Table 2. Although the performance of the two transformations fluctuates under different target labels, they both maintain excellent performance, which once again verifies the versatility of the backdoor trigger proposed in this invention.

[0059] (6) Robustness verification of existing defenses by this invention

[0060] Robustness is also an important indicator for evaluating backdoor attacks, that is, verifying whether the backdoor trigger used in this invention can resist typical backdoor defenses. For better comparison and more intuitive demonstration, in addition to invention I and invention II, backdoor defense experiments of method 1 were also conducted.

[0061] A. Defense based on trigger synthesis

[0062] The papers Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao, “Neuralcleanse: Identifying and mitigating backdoor attacks in neural networks,” in IEEE S&P, 2019 (denoted as the Neural cleanse method), and Edward Chou, Florian Tramer, and Giancarlo Pellegrino, “Sentinet: Detecting localized universal attacks against deep learning systems,” in IEEE S&P Workshop, 2020 (denoted as the Sentinel method), are both defenses based on trigger synthesis. Figure 5 The image shows a backdoor trigger synthesized using the NeuralCleanse method. The NeuralCleanse defense strategy involves synthesizing triggers used in backdoor attacks. Method 1 uses a 3×3 white pixel block in the lower right corner as its trigger, while the triggers in Invention I and Invention II are rotation and translation, respectively. Figure 5 As shown, for method 1, the trigger synthesized by Neural Cleanse is similar to its real trigger (i.e., the white patch in the lower right corner), but the backdoor trigger synthesized by this invention is meaningless, indicating that the backdoor defense method can successfully defend against method 1, but it is ineffective against the attack proposed by this invention.

[0063] Figure 6 Three different methods (Method 1, Invention I, Invention II) are presented for Grad-CAM after poisoning the samples. For example... Figure 6 As shown, the SentiNet method can very accurately distinguish the location of the trigger in Method 1, but it cannot detect the area where the trigger of this invention is located well, indicating that the SentiNet method is also ineffective against the backdoor attack of this invention.

[0064] B. Defense based on classical model repair

[0065] The papers Yuntao Liu, Yang Xie, and Ankur Srivastava, “Neural trojans” in ICCD, 2017 (denoted as the fine-tuning method) and Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks” in RAID, 2018 (denoted as the pruning method) are both defenses based on classical model repair. Furthermore, the resistance of the backdoor trigger used in this invention to model-repair-based backdoor defense methods is also discussed; their approach is to remove the implanted hidden backdoor from the victim model. Figure 7 This diagram illustrates the resistance of backdoor attacks to the fine-tuning defense method according to an embodiment of the present invention. Figure 7 As shown, with the increase of the number of iterations, the attack success rate of Method 1 decreases significantly, but has little impact on the indicators of this invention. Figure 8 This invention demonstrates the resistance of backdoor attacks to the pruning defense method. Figure 8 It can be seen that when the pruning ratio is greater than 30%, the performance of Method 1 will be significantly affected. However, the backdoor attack proposed in this invention will only show a significant decrease when the pruning ratio is greater than 80%, which further verifies the robustness of the method of this invention.

[0066] C. Defense based on advanced model repair

[0067] The defenses based on advanced model repair proposed in the literature Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin, “Bridging mode connectivity in loss landscapes and adversarial robustness” in ICLR, 2020, and the literature Yige Li, Xixiang Lyu, Nodonns Koren, Lingjuan Lyu, BoLi, and Xingjun Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks” in ICLR, 2021, are denoted as MCR and NAD.

[0068] Table 3. Resistance of the backdoor attack proposed in this invention to MCR and NAD.

[0069]

[0070] In addition to classic model repair, this paper also explores the resistance of the backdoor attack proposed in this invention to advanced model repair. According to Table 3, after these two defenses, the attack success rate of Method 1 drops to a very low value, while the attack success rate of the method of this invention decreases but still remains above 60%.

[0071] In summary, the backdoor attack proposed in this invention has extremely strong robustness.

[0072] (7) Verification of the backdoor attack method proposed in this invention in the physical world

[0073] Most existing backdoor attack methods only consider the digital world, but real-world backdoor attacks in physical scenarios are actually more practical. This demonstrates that the method proposed in this invention is effective not only in digital settings but also in physical settings. Taking rotation as an example, using the camera of an Apple iPhone, real traffic signs are photographed from different angles, such as... Figure 9 As shown, the victim model described in the aforementioned experiment of this invention is used to predict the labels of captured images. All images with a specific angle (the set rotation angle) (images in the last column) are "incorrectly" predicted as the target label (i.e., "speed limit 30"), while images with other angles (images in the first to third columns) are predicted as their true labels. Because the last column of images are all rotated to about 16°, which was used in the training of the aforementioned experiment, the network is "misled" into predicting them as the corresponding target label "speed limit 30". The images in columns 1-3 are rotated at other angles (not 16°), so they are still predicted by the network as their original labels. It can be seen that it is also feasible to use real-world images for verification in the physical world, and the hidden backdoor in the victim model can be activated directly by taking pictures.

[0074] Therefore, this invention abandons the idea of ​​introducing backdoor triggers by adding or modifying pixels, which is a common approach in classic backdoor attack methods. Instead, it directly uses real-world spatial transformations as backdoor triggers, making the attack method simple, efficient, highly concealed, robust, and effective. It also reveals that spatial transformations can not only serve as backdoor defenses and disable backdoor attacks by modifying triggers, but also as backdoor triggers for attacks. Experimental verification shows that this invention has been extensively tested on the benchmark dataset (GTSRB), demonstrating the effectiveness of the proposed method compared to different backdoor attack methods. The method boasts high benign accuracy and a very high attack success rate. Furthermore, this invention decomposes factors affecting backdoor attack performance, such as trigger size and target label type, proving that it maintains excellent performance under different settings. Beyond digital scenarios, this invention also verifies and demonstrates the effectiveness of the proposed method in the real physical world, contributing to the future application of backdoor attacks in real-world scenarios. The ideas provided by this invention can be applied to fields with high security requirements, such as intelligent driving and facial recognition, providing new ideas for the future development of artificial intelligence security issues such as backdoor attacks and backdoor defenses, and further improving the security of neural network models.

[0075] This invention also proposes a backdoor attack device based on spatial transformation, which is adapted to the backdoor attack method of the foregoing embodiments of this invention. The device includes: a poisoned image generator, used to perform spatial transformation with set parameters on a portion of image samples randomly selected from the original dataset, and change the labels of these image samples to the target label, obtaining a poisoned subset; a benign sample processor, used to perform spatial transformation with random parameters on the remaining benign image samples in the original dataset, while keeping the labels unchanged, obtaining a benign subset; and a standard training module, used to perform standard training of a deep learning classification model using the poisoned dataset composed of the poisoned subset and the benign subset, constructing a victim model with a hidden backdoor implanted, such that the victim model has the following characteristics: when performing classification prediction, its hidden backdoor can be activated by samples in the dataset to be classified that have undergone the spatial transformation with set parameters, causing the samples in the dataset to be classified that have undergone the spatial transformation with set parameters to be incorrectly predicted as the target label, while the remaining samples can be correctly predicted as the true label.

[0076] Furthermore, this embodiment of the invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can implement the steps of the backdoor attack method based on spatial transformation described in the foregoing embodiments.

[0077] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several equivalent substitutions or obvious modifications can be made without departing from the concept of the present invention, and all such modifications, achieving the same performance or purpose, should be considered within the scope of protection of the present invention.

Claims

1. A method of spatial transformation based backdoor attack, characterized in that, The method comprises the following steps: a part of image samples are randomly selected from an original data set for a space transformation with set parameters, and the labels of the part of image samples are changed to target labels, and the remaining benign image samples in the original data set are subjected to a space transformation with random parameters while keeping the labels unchanged, so as to process the original data set into a poisoned data set; the space transformation with set parameters comprises translation by a set distance, and the space transformation with random parameters comprises translation by a random distance, and the random distance is randomly translated in a distance range not containing the set distance; the translation distance of the space transformation with random parameters is selected from a range of [-3, 3] pixels; a standard training of a deep learning classification model is performed using the poisoned data set to construct a victim model implanted with a hidden backdoor; when the victim model performs classification prediction, the hidden backdoor can be activated by samples in a to-be-classified data set subjected to the space transformation with set parameters, so that the samples in the to-be-classified data set subjected to the space transformation with set parameters are incorrectly predicted as target labels, and the remaining samples can be correctly predicted as real labels; the space transformation-based backdoor attack method is effective for images taken in a physical world, and images in the physical world subjected to the space transformation with set parameters can activate the backdoor and are predicted as target labels, and images in the physical world not subjected to the space transformation with set parameters are predicted as real labels.

2. An apparatus for a spatial transformation based backdoor attack, the apparatus comprising: The method comprises the following steps: a poisoned image generator is configured to perform a space transformation with set parameters on part of image samples randomly selected from an original data set, and change the labels of the part of image samples to target labels to obtain a poisoned subset; the space transformation with set parameters comprises translation by a set distance; a benign sample processor is configured to perform a space transformation with random parameters on the remaining benign image samples in the original data set while keeping the labels unchanged to obtain a benign subset; the space transformation with random parameters comprises translation by a random distance, and the random distance is randomly translated in a distance range not containing the set distance; the translation distance of the space transformation with random parameters is selected from a range of [-3, 3] pixels; a standard training module is configured to perform a standard training of a deep learning classification model using a poisoned data set composed of the poisoned subset and the benign subset to construct a victim model implanted with a hidden backdoor, so that the victim model has the following characteristics: when the victim model performs classification prediction, the hidden backdoor can be activated by samples in a to-be-classified data set subjected to the space transformation with set parameters, so that the samples in the to-be-classified data set subjected to the space transformation with set parameters are incorrectly predicted as target labels, and the remaining samples can be correctly predicted as real labels; the space transformation-based backdoor attack method is effective for images taken in a physical world, and images in the physical world subjected to the space transformation with set parameters can activate the backdoor and are predicted as target labels, and images in the physical world not subjected to the space transformation with set parameters are predicted as real labels.

3. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by a processor to implement the steps of the space transformation-based backdoor attack method of claim 1.

Images