Trigger reverse restoration method for speech recognition backdoor attack

Abstract

This invention relates to a method for reversing triggers used in speech recognition backdoor attacks, belonging to the field of artificial intelligence security technology. The main technical solution includes: 1. Constructing a poisoning training set; 2. Calculating a similarity matrix of the poisoning training set samples; 3. Detecting potential poisoning samples based on the similarity matrix; 4. Reversing triggers using the potential poisoning samples; 5. Decontaminating the poisoning training set to obtain a decontaminated training set; 6. Training a model using the poisoning training set and the decontaminated training set respectively; 7. Testing and comparing the model recognition results before and after decontamination. This invention obtains potential poisoning samples through speech endpoint detection and speech similarity, and reverse-engineers the triggers used by the poisoning samples, thereby decontaminating the training set, weakening the backdoor attack effect of the poisoning samples, and reducing the impact of backdoor attacks on the model.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, specifically to a method for reversing and restoring triggers for speech recognition backdoor attacks. Background Technology

[0002] With the development of internet technology, artificial intelligence (AI) technology has been widely applied to various fields of society, greatly changing people's lifestyles and improving their living standards. As the core of AI technology, the reliability of intelligent models' decision-making capabilities is closely related to the training set used for model training. Poisoning attacks, which use polluting the training set as a means of attack, undoubtedly bring new challenges to AI security. In 2019, Tianyu Gu et al. first proposed the concept of backdoor attacks. By generating poisoned samples with triggers, backdoors are left in the model by polluting the dataset, enabling the model to make correct decisions on normal samples and specifically exhibit decisions that meet the attacker's expectations for samples with triggers, making the attack more covert. Therefore, backdoor attacks and their defenses have gradually become a research hotspot in the field of AI security.

[0003] The University of Electronic Science and Technology of China (UESTC) proposed a method for detecting backdoor attacks on neural network models in its patent application, "A Method for Detecting Backdoor Attacks on Neural Network Models" (Patent Application No.: 202110068380.2, Publication No.: CN112765607A). This method includes the following steps: S1, collecting input data during neural network operation; S2, optimizing and training the control gates to obtain the optimal control gates for each image and each class; S3, generating key neurons; S4, calculating an index based on the numerical features of the key path; and S5, calculating an anomaly index based on the index to determine whether the neural network model has been attacked by a backdoor. This invention represents the internal information of the model in the form of key paths, improving the reliability of the backdoor attack detection method. However, this method still has shortcomings: backdoor attack detection occurs after model training, meaning a backdoor has already been left in the model; and neuron computation is too time-consuming when detecting backdoor attacks on complex neural networks.

[0004] Wuhan University proposed a method and system for resisting neural network backdoor attacks based on image feature analysis in its patent application "A Method for Generating Image Adversarial Samples" (patent application number: 202110398727.X, publication number: CN 113205115A). This method includes data processing and model initialization; data augmentation to obtain a clean dataset when a new model needs to be trained and there is insufficient benign data; common feature analysis of benign data based on the initial deep neural network model, including feature selection and feature extraction; feature difference analysis; preliminary screening of malicious data based on a centroid defense strategy; and secondary screening of suspicious data based on a deep KNN defense strategy. This invention solves the problem that traditional manual screening methods for poisoned samples are not suitable for backdoor attacks based on covert triggers. However, this method still has shortcomings: it cannot find the triggers used by the attacker; and when there are many poisoned samples, removing poisoned samples from the training set can lead to an imbalance in the training set data, affecting the model's predictive performance. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] The technical problem to be solved by this invention is: how to design a trigger reverse restoration method for speech recognition backdoor attacks, which can reverse restore the triggers used by the poisoned sample, weaken the backdoor attack effect of the poisoned sample, and reduce the impact of the backdoor attack on the model.

[0007] (II) Technical Solution

[0008] To address the aforementioned technical problems, this invention provides a method for reversing and restoring triggers to counter backdoor attacks in speech recognition, comprising the following steps:

[0009] (1) Construct a poisoning training set;

[0010] (2) Calculate the similarity matrix of the samples in the poisoning training set;

[0011] (3) Detect potential poisoning samples based on the similarity matrix;

[0012] (4) Use potential poisoned samples to reverse-engineer the trigger;

[0013] (5) Based on the reverse restoration trigger, the poisoning training set is decontaminated to obtain the decontaminated training set;

[0014] (6) Train the model using the poisoning training set and the decontamination training set respectively to obtain the model before and after decontamination;

[0015] (7) Test and compare the model recognition results before and after decontamination.

[0016] Preferably, step 1 includes:

[0017] (1a) Select source and target classes from the voice command training set;

[0018] (1b) Select some samples from the source class, add triggers, and generate poisoned samples;

[0019] (1c) The poisoned sample is placed into the target class of the training set to form the poisoning training set.

[0020] Preferably, step 2 includes:

[0021] (2a) Standardize the samples in the poisoning training set;

[0022] (2b) Use the endpoint detection algorithm to detect the sound production location of the sample and obtain the speech production segment of the sample;

[0023] (2c) Calculate the MFCC acoustic features of each sample using speech segments;

[0024] (2d) Using the Dynamic Time Warping (DTW) algorithm, the similarity between the acoustic features of the sample MFCC is calculated to obtain the similarity matrix.

[0025] Preferably, step 3 includes:

[0026] (3a) Using the similarity matrix, calculate the anomaly degree of each sample to obtain the anomaly degree array;

[0027] (3b) Sort the anomaly array and take the sample corresponding to the largest part of the anomaly array as the potential poisoning sample.

[0028] Preferably, in step 4, the potential poisoning sample is used to perform reverse reconstruction of the trigger, using the formula... The trigger is reversed by summing each element of all potential poisoning samples and then dividing by the number of potential poisoning samples, where x i Let n be the i-th sample in the target class, and n be the number of potential poisoning samples. i This is an additive global trigger for reverse restoration.

[0029] Preferably, in step 5, the reverse restoration trigger is subtracted from all potential poisoning samples to obtain decontaminated samples. The decontaminated samples are then restored to the source class through human auditory recognition to obtain a decontaminated training set.

[0030] Preferably, step 6 includes:

[0031] (6a) The model was trained using the poisoning training set to obtain the model before decontamination;

[0032] (6b) The model is trained using the decontamination training set to obtain the decontamination model.

[0033] Preferably, step 7 includes:

[0034] (7a) Input the clean samples in the test set into the models before and after decontamination respectively, and calculate the clean sample recognition accuracy.

[0035] (7b) Add triggers to clean samples in the test set to form backdoor samples;

[0036] (7c) Input the backdoor sample into the model before and after decontamination respectively, and calculate the backdoor sample identification accuracy, i.e. the probability that the backdoor sample is identified as the source class, and the backdoor sample attack success rate, i.e. the probability that the backdoor sample is identified as the target class.

[0037] Preferably, in step (1b), the clean sample x is added element by element to the trigger according to the formula x′=x+trigger to generate the poisoned sample, wherein the trigger is a global trigger with the same size as the clean sample x.

[0038] Preferably, in step (2a), according to the formula The samples in the poisoning training set are standardized, and the values ​​of all samples are restricted to the range [-1, 1], where x represents a sample in the poisoning training set. normalized Let x represent the standardized sample, and max(·) and abs(·) be the maximum value function and the absolute value function, respectively.

[0039] Preferably, in step (2b), a sliding window-based endpoint detection algorithm is used to detect the endpoints of the sound emission location of the sample, according to the formula std_list. i =std(x[i*step:i*step+len]) calculates the standard deviation array std_list, where i is the index of the sliding window, and std_list i Let be the standard deviation of the i-th sliding window, std(·) be the standard deviation function, x be the sample, step be the sliding window step size, and len be the sliding window size. The vocal threshold is calculated using the formula threshold = 0.6 * mean(sort(std_list)[-16:]), where "-16:" represents the last 16 elements, and mean(·) and sort(·) are the mean function and sorting function, respectively. The vocal threshold is calculated using the formulas...

[0040] start_index=(std_list>threshold)[0]*len

[0041] end_index=(std_list>threshold)[-1]*len

[0042] Obtain the starting position index start_index and the ending position index end_index of the vocalization, and extract the vocalization segment x′ of sample x using the formula x′=x[start_index:end_index].

[0043] Preferably, in step (2d), the similarity of the acoustic features of the sample MFCC is calculated using the Dynamic Time Warping (DTW) algorithm to obtain the similarity matrix, where, according to the formula... Calculate sample x i With x j The similarity of acoustic features of MFCC, where DTW(·) represents the dynamic time warping function. and They represent samples x respectively i With x j Acoustic characteristics of MFCC, similarity i,j The element in the i-th row and j-th column of the similarity matrix represents sample x. i With x j The similarity.

[0044] Preferably, in step (3a), the formula abnormal_list = mean(similarity) is used. i The arithmetic mean of each row in the similarity matrix is ​​used to obtain the anomaly score array. The arithmetic mean of each row in the similarity matrix represents the anomaly score of a sample in the poisoning training set, measuring the difference between that sample and other samples. Here, `abnormal_list` represents the anomaly score array, and `mean(·)` is the mean function. i This represents the i-th row of the similarity matrix.

[0045] (III) Beneficial Effects

[0046] First, this invention obtains potential poisoning samples through voice similarity, can reverse-engineer the triggers used by the poisoning samples, and can perform decontamination operations on the training set before model training, thereby weakening the backdoor attack effect of the poisoning samples.

[0047] Second, the trigger reverse restoration method used in this invention has a reverse restoration effect on both additive global triggers and replaced fixed-position local triggers, and can restore triggers used by more backdoor attack methods to resist backdoor attacks. Attached Figure Description

[0048] Figure 1 This is a flowchart of the method of the present invention;

[0049] Figure 2(a) shows the acoustic spectrum of the actual trigger;

[0050] Figure 2(b) shows the spectrogram of the trigger after reverse restoration. Detailed Implementation

[0051] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0052] This invention studies speech recognition models and provides a method for reversing triggers to detect backdoor attacks in speech recognition. Compared with other backdoor attack detection methods, this invention can use the reversal operation to obtain the triggers used by the poisoned sample, decontaminate the training set, weaken the backdoor attack effect of the poisoned sample, and reduce the impact of backdoor attacks on the model.

[0053] The following will be combined with the appendix Figure 1 The method of the present invention will be further described with reference to specific embodiments:

[0054] Step 1: Construct a poisoning training set.

[0055] Select the source class "stop" and the target class "go" in the Speech Command training set;

[0056] Randomly select 15% of the samples in the source class "stop", add triggers, and perform element-wise addition of the clean sample x and the trigger according to the formula x′=x+trigger to generate poisoned samples. The trigger is a global trigger with the same size as the clean sample x, and the general speech anti-interference action is used as the global trigger.

[0057] The poisoned samples are added to the target class "go" in the training set to form the poisoning training set.

[0058] Step 2: Calculate the similarity matrix of the poisoning training set samples.

[0059] Standardize the poisoning training set samples according to the formula. The poisoning training set samples are standardized, and the values ​​of all samples are restricted to the range [-1, 1], where x represents a sample in the poisoning training set. normalized Let x represent the standardized sample, and max(·) and abs(·) be the maximum value function and the absolute value function, respectively.

[0060] An endpoint detection algorithm based on a sliding window is used to detect the sound emission locations of the samples, according to the formula std_list. i=std(x[i*step:i*step+len]) calculates the standard deviation array std_list, where i is the index of the sliding window, and std_list i Let be the standard deviation of the i-th sliding window, std(·) be the standard deviation function, x be the sample, step be the sliding window step size, and len be the sliding window size. The vocal threshold is calculated using the formula threshold = 0.6 * mean(sort(std_list)[-16:]), where "-16:" represents the last 16 elements, and mean(·) and sort(·) are the mean function and sorting function, respectively. The vocal threshold is calculated using the formulas...

[0061] start_index=(std_list>threshold)[0]*len

[0062] end_index=(std_list>threshold)[-1]*len

[0063] Obtain the starting position index start_index and the ending position index end_index of the vocalization, and extract the vocalization segment x′ of sample x using the formula x′=x[start_index:end_index].

[0064] MFCC is used as the acoustic feature of the training set to calculate the MFCC acoustic features of the sample sound segments.

[0065] The similarity of acoustic features of samples using the Dynamic Time Warping (DTW) algorithm is calculated to obtain the similarity matrix, where, according to the formula... Calculate sample x i With x j The similarity of acoustic features of MFCC, where DTW(·) represents the dynamic time warping function. and They represent samples x respectively i With x j Acoustic characteristics of MFCC, similarity i,j The element in the i-th row and j-th column of the similarity matrix represents sample x. i With x j The similarity.

[0066] Step 3: Detect potential poisoning samples based on the similarity matrix.

[0067] According to the formula abnormal_list = mean(similarity) iThe arithmetic mean of each row in the similarity matrix is ​​used to obtain the anomaly array. The arithmetic mean of each row in the similarity matrix represents the anomaly of a sample in the poisoning training set, measuring the difference between that sample and other samples. Here, `abnormal_list` represents the anomaly array, and `mean(·)` is the mean function. i This represents the i-th row of the similarity matrix.

[0068] Sort the anomaly index array in descending order, and take the samples corresponding to the top 15% of the elements in the anomaly index array as potential poisoning samples.

[0069] Step 4: Use potential poisoning samples to reverse engineer the trigger.

[0070] Using potential poisoning samples to reverse engineer the trigger, and using the formula The trigger is then reverse-engineered by summing each element of all potential poisoning samples and dividing by the number of potential poisoning samples, where x i Let 1000 be the number of potential poisoning samples in the target class, and trigger be the i-th sample in the target class. i This is an additive global trigger for reverse restoration.

[0071] Step 5: Decontaminate the poisoned training set to obtain a decontaminated training set.

[0072] Subtract the reverse restoration trigger from all potential poisoning samples in the target class "go" of the poisoning training set to obtain the decontamination samples. Then, restore the decontamination samples to the source class "stop" through human auditory recognition to obtain the decontamination training set.

[0073] Step 6: Train the model using the poisoning training set and the decontamination training set respectively.

[0074] The model was trained on the poisoning training set and the decontamination training set respectively to obtain the model before decontamination and the model after decontamination.

[0075] Step 7: Test and compare the model recognition results before and after decontamination.

[0076] The clean samples from the test set are input into the models before and after decontamination, and the recognition accuracy of the clean samples is calculated. Triggers are added to the clean samples in the test set to form backdoor samples. The backdoor samples are input into the models before and after decontamination, and the recognition accuracy (probability of the backdoor sample being recognized as the source class) and attack success rate (probability of the backdoor sample being recognized as the target class) of the backdoor samples are calculated.

[0077] Experiments have verified that this invention can reverse engineer the triggers used by the detected potential poisoning samples, and can use the reverse engineered triggers to weaken the backdoor attack effect of poisoning samples in the training set, thereby reducing the impact of backdoor attacks on the model.

[0078] The effects of the present invention will be further described below with reference to simulation experiments.

[0079] 1. Simulation experimental conditions:

[0080] The software platform for the simulation experiment of this invention is: Windows 10 operating system and Spyder integrated development environment.

[0081] The hardware platform for the simulation experiment of this invention is: Intel Core™ i7-9700K@3.60GHz×8, GPU Nvidia GeForce GTX 1080Ti, 11GB video memory.

[0082] The Python version used in the simulation experiment of this invention is Python 3.7.3, and the libraries and their corresponding versions are pytorch 1.1.0, torchvision 0.3.0, opencv-python4.4.0, and numpy 1.21.0, respectively.

[0083] 2. Simulation content and results:

[0084] The simulation experiment of this invention selects a source class and a target class in the training set, and adds triggers to some samples from the source class to form poisoned samples, which are then sent to the target class to construct a poisoned training set. Potential poisoned samples are detected using a speech endpoint detection algorithm and speech similarity. The triggers are then reverse-engineered using these potential poisoned samples, and the reverse-engineered triggers are used to weaken the backdoor attack effect of the poisoned samples, thus decontaminating the training set. The models before and after decontamination are trained using the training sets before and after decontamination. Backdoor samples are generated based on clean samples from the test set. The clean samples and backdoor samples are input into the models before and after decontamination, respectively. The accuracy rates of clean sample recognition, backdoor sample recognition, and backdoor sample attack success rates are statistically analyzed to observe the impact of backdoor attacks on the models before and after decontamination.

[0085] The simulation results of this invention are shown in Figure 2. Figure 2(a) shows the spectrograms of the real triggers used by the poisoned samples and backdoor samples. Potential poisoned samples in the poisoned training set are detected using speech similarity, and the triggers are then reverse-engineered using these samples to obtain the reverse-engineered trigger shown in Figure 2(b). The waveform changes of the spectrograms of the reverse-engineered trigger and the real trigger are basically consistent. The model is trained using the poisoned training set and the decontamination training set (both before and after decontamination) to obtain the models before and after decontamination. The accuracy rates for clean sample recognition, backdoor sample recognition, and backdoor sample attack success rates are statistically analyzed. The results are shown in the "Statistical Table of Model Recognition Results Before and After Decontamination". After decontamination, the accuracy rate for clean sample recognition decreases slightly, the accuracy rate for backdoor sample recognition increases, and the backdoor sample attack success rate decreases.

[0086] Statistical table of model identification results before and after decontamination

[0087]

[0088] As can be seen, this invention detects potential poisoning samples by voice similarity and reverse-engineers the triggers used by the poisoning samples. It can use the reverse-engineered triggers to weaken the backdoor attack effect of poisoning samples in the poisoning training set, thereby decontaminating the training set and reducing the impact of backdoor attacks on the model.

[0089] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered as protection of the present invention.

Claims

1. A method for reversing triggers to recover from backdoor attacks in speech recognition, characterized in that, Includes the following steps: (1) Construct a poisoning training set; (2) Calculate the similarity matrix of samples in the poisoning training set; (3) Detect potential poisoning samples based on the similarity matrix; (4) Using potential poisoned samples to reverse-engineer the trigger; (5) Based on the reverse restoration trigger, the poisoning training set is decontaminated to obtain the decontaminated training set; (6) Train the model using the poisoning training set and the decontamination training set respectively to obtain the model before and after decontamination; (7) Test and compare the model recognition results before and after decontamination; In step 4, the trigger is reversed using the potential poisoning sample, and the formula is used. The trigger is reversed by summing each element of all potential poisoned samples and then dividing by the number of potential poisoned samples. For the first in the target class One sample, The number of potential poisoning samples. An additive global trigger for reverse restoration; In step 5, the reverse restoration triggers are subtracted from all potential poisoning samples to obtain decontaminated samples. The decontaminated samples are then restored to the source class through human auditory recognition to obtain the decontaminated training set.

2. The method as described in claim 1, characterized in that, Step 1 includes: (1a) Select source and target classes from the voice command training set; (1b) Select some samples from the source class, add triggers, and generate poisoned samples; (1c) The poisoned sample is placed into the target class of the training set to form the poisoning training set.

3. The method as described in claim 1, characterized in that, Step 2 includes: (2a) Standardize the samples in the poisoning training set; (2b) Use the endpoint detection algorithm to detect the sound production location of the sample and obtain the speech production segment of the sample; (2c) Calculate the MFCC acoustic features of each sample using speech segments; (2d) Using the Dynamic Time Warping (DTW) algorithm, the similarity between the acoustic features of the sample MFCC is calculated to obtain the similarity matrix.

4. The method as described in claim 1, characterized in that, Step 3 includes: (3a) Using the similarity matrix, calculate the anomaly degree of each sample to obtain the anomaly degree array; (3b) Sort the anomaly array and take the sample corresponding to the largest part of the anomaly array as the potential poisoning sample.

5. The method as described in claim 1, characterized in that, Step 7 includes: (7a) Input the clean samples in the test set into the models before and after decontamination respectively, and calculate the accuracy of clean sample recognition; (7b) Add triggers to clean samples in the test set to form backdoor samples; (7c) Input the backdoor sample into the model before and after decontamination respectively, and calculate the backdoor sample identification accuracy, i.e. the probability that the backdoor sample is identified as the source class, and the backdoor sample attack success rate, i.e. the probability that the backdoor sample is identified as the target class.

6. The method as described in claim 2, characterized in that, In step (1b), according to the formula Clean sample With triggers Element-by-element addition generates a poisoned sample, where the trigger... For size and clean sample Same global trigger.

7. The method as described in claim 3, characterized in that, In step (2a), according to the formula The samples in the poisoning training set are standardized to restrict the values ​​of all samples to a certain range. ,in This represents the samples in the poisoning training set. Represents the standardized sample , and These are the maximum value function and the absolute value function, respectively.

8. The method as described in claim 3, characterized in that, Step (2b) uses a sliding window-based endpoint detection algorithm to detect the sound emission location of the sample, according to the formula. The standard deviation array was calculated. ,in The number is the sequence number of the sliding window. For the first The standard deviation of a sliding window It is a function of standard deviation. As a sample, The step size for moving the sliding window. The size of the sliding window is determined by the formula. Calculate the vocal threshold Where "-16:" represents the last 16 elements. and These are the average function and the ranking function, respectively, using the formulas... Get the index of the start position of the sound Index of the position of the end of the sound And through the formula =x [ start_index : end_index Extracting samples vocal clips .

9. The method as described in claim 3, characterized in that, In step (2d), the similarity of the acoustic features of the sample MFCC is calculated using the Dynamic Time Warping (DTW) algorithm, resulting in a similarity matrix. , where, according to the formula Calculate samples and Similarity of acoustic features of MFCC, among which This represents a dynamic time warping function. and Representing samples respectively and MFCC acoustic characteristics Similarity matrix No. Line number The elements of the column represent samples. and The similarity.

10. The method as described in claim 4, characterized in that, In step (3a), according to the formula The arithmetic mean of each row in the similarity matrix is ​​calculated to obtain the anomaly score array. The arithmetic mean of each row in the similarity matrix represents the anomaly score of a sample in the poisoning training set, measuring the difference between that sample and other samples. Represents the anomaly index array. It is a function of average value. The first similarity matrix OK.

Images