Backdoor attack design and evaluation system and method for SAR image DNN classifier

Abstract

The present invention discloses a backdoor attack design and evaluation system and method for a SAR image DNN classifier. The system obtains an image dataset from a SAR historical database, performs data analysis and normalization on the dataset to obtain a clean dataset, and then trains a DNN model to obtain a clean model. A multi-objective offline optimization design module based on backdoor attack triggers is used to obtain the optimal backdoor trigger, which is injected into the clean dataset to be poisoned to generate a backdoor attack dataset. The clean model is then trained to obtain a poisoned model with a backdoor embedded in it, and the test accuracy, backdoor concealment, and attack success rate are evaluated. This invention, for the first time, achieves multi-objective automatic optimization of backdoor embedded triggers for SAR image DNN classifiers. While maintaining the high concealment of the backdoor trigger, it achieves an extremely high attack success rate using only a small number of backdoor samples, and quantitatively evaluates the security risks and performance after a backdoor attack.

Description

Technical Field

[0001] The present invention relates to the technical field of backdoor attack on Synthetic Aperture Radar (SAR) image classification in the field of intelligent remote sensing, and in particular to a backdoor attack design and evaluation system and method for a SAR image DNN (Deep Neural Network) classifier. Background Art

[0002] Deep Neural Networks (DNNs) have achieved tremendous success in fields like image recognition and classification. However, they are highly vulnerable to attacks at various stages, such as poisoning attacks and backdoor attacks during training, and adversarial attacks during testing. These attacks have raised security concerns regarding various DNN model application scenarios. Poisoning attacks involve poisoning training data, which degrades model performance. Adversarial attacks perturb test data, thereby affecting inference results. Backdoor attacks are more flexible than the previous two. Without compromising model performance, they embed a backdoor into the model by poisoning the training data. This allows the model to perform malicious actions at the attacker's command when triggered.

[0003] Synthetic Aperture Radar (SAR) is an active microwave imaging sensor unaffected by factors such as cloud, fog, and illumination. It can observe target areas at any time, leading to its widespread application in both civilian and military fields. SAR image detection and recognition are becoming increasingly important. Currently, backdoor attack research focuses on traditional natural image data such as handwriting recognition, face recognition, and traffic sign recognition, ignoring the potential harm of backdoor attacks to the SAR imagery field. If an attacker were to launch a backdoor attack on a SAR image detection system, the compromised SAR classification system would pose significant risks to national military operations. It is worth noting that SAR images are single-channel grayscale images, making many backdoor attacks designed for RGB channel images inapplicable to SAR images. Therefore, the design, performance evaluation, and defense strategies for backdoor attacks targeting SAR images are crucial current and future research topics in the field of SAR image information security. It is particularly noteworthy that when the stealthiness of the trigger in a backdoor attack increases, it will cause a partial loss in the attack success rate or a decrease in the model's performance on clean data. Existing backdoor attack methods for traditional natural images find it difficult to achieve a good balance between test accuracy, attack success rate, and stealth.

[0004] In summary, how to design a backdoor trigger for SAR image DNN classifier that optimizes the compromise between backdoor attack concealment, attack success rate and the original performance of the DNN model is a core technical problem that needs to be solved urgently. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a backdoor attack design and evaluation system and method for SAR image DNN classifiers.

[0006] The objectives of the present invention are achieved through the following technical solutions: In a first aspect, an embodiment of the present invention provides a backdoor attack design and evaluation system for a SAR image DNN classifier, the system comprising a SAR image data acquisition module, a backdoor trigger multi-objective offline optimization design module, and a backdoor attack embedding and performance evaluation module;

[0007] The SAR image data acquisition module is used to obtain the center of the target to be detected based on the high-resolution image of the SAR historical database, expand 128 pixels outward from the center of the minimum circumscribed eccentric circle of the target center as the midpoint, and obtain a SAR image slice data set of size 256 pixels × 256 pixels. The image slice data set is normalized and labeled, and divided into a clean training set, a clean validation set, and a data set to be poisoned. The clean training set, clean validation set, and data set to be poisoned are used as inputs to the backdoor trigger multi-objective offline optimization design module; at the same time, the data set to be poisoned is used as input to the backdoor attack embedding and performance evaluation module.

[0008] The backdoor trigger multi-objective offline optimization design module is used to obtain the optimal trigger design solution based on the multi-objective backdoor trigger optimization solver, and transmit the optimal trigger design solution to the backdoor attack embedding and performance evaluation module;

[0009] The backdoor attack embedding and performance evaluation module is used to inject the optimal backdoor trigger into the data set to be poisoned to form a poisoned data set, merge the clean training set and the poisoned data set to obtain a backdoor attack data set, train the SAR image DNN classification model on the backdoor attack data set to obtain a poisoned model embedded with a backdoor, make the poisoned model output the trigger-specified operation, and evaluate the test accuracy, backdoor concealment, and attack success rate of the clean model and the poisoned model.

[0010] A second aspect of the present invention provides a backdoor attack design and evaluation method for a SAR image DNN classifier using the above system, comprising the following steps:

[0011] (1) The SAR image data acquisition module obtains the center of the target to be detected, slices the image, and labels the category of the SAR high-resolution image to obtain the source data set X. The size of each image is scaled to 256 pixels × 256 pixels, and the data is normalized according to formula (1) to obtain the clean data set X. o , X o Split in a ratio of 4:1:1 to obtain a clean training set X o-train , clean validation set X o-valid and the dataset to be poisoned X o-poi :

[0012]

[0013] Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j represents the feature of the j-th dimension of the source dataset X, and d represents X o The maximum value of the dimension;

[0014] (2) Setting the parameter values ​​of the backdoor trigger multi-objective offline optimization design module, the parameter values ​​include the standard deviation Std of the generated Gaussian noise, the number of disturbance sizes B selected from the Gaussian noise, and the number of perturbations. k , DNN model Model, DNN model training round Epoch, DNN model training learning rate Lr, population size N, trigger design optimization iteration number I, crossover rate σ, mutation rate θ, the number of regions the trigger is divided into during adaptive mutation N r , the number of mutation pixels B m and mutation cumulative probability update interval generation N g ;

[0015] (3) Initialize N individuals as the initial population Q: Each individual represents a trigger design, and its encoding form is x i =[A mn ,ε], where A is a zero-one matrix with m rows and n columns, m and n are the width and height of the input SAR image respectively, and the number of elements in A that are 1 is B k , ε is a random noise matrix with a Gaussian distribution and a standard deviation of Std. The dimension of the matrix is ​​m rows and n columns;

[0016] (4) Performance evaluation of population Q: Based on the information represented by each individual in Q, generate a backdoor trigger η according to formula (2), and inject the backdoor trigger η into the poisoned dataset X in the form of formula (3). o-poi , and modify its corresponding real type to the type that the attacker wants the model to output, and obtain the poisoned dataset X o-poied ; poisoned dataset Xo-poied Divide into poisoned training set X according to the ratio of 5:4 o-poied-train and the poisoned test set X o-poied-valid , the poisoned training set X o-poied-train and clean training set X o-train Merge to generate backdoor dataset X o-back , X o-back As the data input of the DNN model Model, the Epoch round of training is carried out to generate a poisoned model. The poisoned model is tested on the clean validation set X o-valid and the poisoned test set X o-poied-valid Test on the clean validation set X and calculate the o-valid and the poisoned test set X o-poied-valid The target values ​​f1 and f2 on X, where f1 represents the DNN model o-valid The prediction error on X is represented by f2, which indicates the DNN model’s o-poied-valid The prediction error on , the concealment f3 of the backdoor trigger is calculated according to formula (6), where f3 represents the Euclidean distance between the poisoned image and the clean image;

[0017] η=A mn ×ε (2)

[0018] X o_poied =X o_poi (1-A mn )+η (3)

[0019]

[0020] Among them, N clean_err For X o-valid The number of samples with incorrect predictions, N clean_all For X o-valid The total number of samples;

[0021]

[0022] Among them, N poi_err For X o-poied-valid The number of samples with incorrect predictions, N poi_all For X o-poied-valid The total number of samples;

[0023]

[0024] Where P is the poisoned image, X is the clean image, r is the row size of the SAR image, and c is the column size of the SAR image;

[0025] (5) Count the f1 value, f2 value and f3 value of each individual in the population Q. If the individual x iThe f1 value, f2 value and f3 value of the individual x are all smaller than those of the individual x. j The f1 value, f2 value and f3 value of individual x are called i Disposable individuals x j ; Individual x j The number of dominated individuals n j At the same time as adding 1, the individual x j Join individual x i Dominated individual set s i Compare the dominance between individuals to obtain the number of dominated individuals n and the dominance set s of each individual; find individuals whose n is 0 in the population and save them in the set F1; traverse the set s dominated by each individual in F1, and perform n on each individual g in s g =n g -1, if n exists g = 0, add it to the set F2; repeat the above operation on F2 until the entire population Q is divided into sets F of different levels;

[0026] (6) For the population Q that has been ranked by dominance, for each level set F k , where 1≤k≤N, sort in ascending order according to f1 value, f2 value and f3 value respectively, and calculate F k The congestion degree of each individual M in is calculated according to formula (7):

[0027]

[0028] Among them, M d represents the crowding degree of individual M, f l M+1 represents the target value f of individual M+1 l , f l M-1 represents the target value f of individual M-1 l ;

[0029] (7) According to the binary bidding competition method, two individuals are selected from the population Q as parent individuals, and a floating point number e1 between 0 and 1 is randomly generated. The relationship between e1 and the crossover rate σ is determined. If e1>σ, then there is no need for crossover between the parent individuals; otherwise, the two parent individuals are marked as and x 1 and x 2 According to formula (2), η is generated 1 and η 2 ; Randomly generate a zero-one matrix B of size m×n, implement the crossover operation between the two parent individuals according to formula (8), and obtain two offspring individuals, marked as c1 and c 2 ;

[0030]

[0031] The offspring c 1 and c 2 Store it in the new population set P and repeat the above operation until the size of set P is equal to the size of population Q;

[0032] (8) Traverse all individuals in the new population P and perform mutation operations on their corresponding triggers η; o-back The image is divided into N r There are regions of the same size, the pixels in each region share the same importance, and a random initial mutation probability P is set for each region. mua The pixel area position of each individual mutation is selected according to the different mutation probabilities of each area using the roulette wheel selection method. When an individual mutates, the number of successful or failed mutations is recorded. Success means that the f2 value of the mutated offspring is smaller than that of the parent, while failure means the opposite. g After generations, the mutation probability P of each region is calculated according to formula (9) and formula (10). mua To update:

[0033]

[0034] Among them, S all represents the sum of all successful mutations, S h represents the number of successful mutations in the hth region;

[0035]

[0036] in, represents the mutation probability P of the jth region after update mua ;

[0037] Select a parent x from the population i , randomly generate a floating point number e2 between 0 and 1, and judge the relationship between e2 and mutation rate θ. If e2>θ, the individual does not need to mutate; otherwise, generate a zero-one matrix B2 with the same dimension as the SAR image, in which the position of element 1 is based on the mutation probability Choose B by roulette m According to formula (11), the individuals are mutated; the population after the mutation operation is marked as P M ;

[0038] c i =x i×(1-B2)+η×B2 (11)

[0039] (9) The population P M Merge with population Q to obtain population R. According to the performance evaluation method described in step (4), evaluate the target values ​​of f1, f2 and f3 for population R. According to step (5), perform non-dominated sorting on population R. According to step (6), calculate the crowding degree of the non-dominated sorted population R. In each set F, sort them from small to large according to the crowding degree. Select the first N individuals of the sorted population R to form the new offspring population Q. n ;

[0040] (10) Unconditionally accept Q = Q n ;

[0041] (11) Repeat steps (4) to (10) until the set number of iterative optimization times I is met;

[0042] (12) The individual with the smallest crowding degree in the final F1 set is taken as the optimal individual X best , to obtain the optimal backdoor trigger in the SAR image DNN classification model;

[0043] (13) According to the method of formula (2), a backdoor trigger is generated according to the optimal backdoor trigger encoding information obtained in step (12), and it is applied to the poisoned data set X according to the method of step (4). o-poi Generate backdoor dataset X o-back , poisoned test set X o-poied-valid ;

[0044] (14) In the clean training set X o-train Train the DNN model Model to obtain a clean model M clean , in the backdoor dataset X o-back Train the DNN model Model to obtain the poisoned model M embedded with the backdoor poi ;

[0045] (15) Using M poi For the validation set X o-valid Perform SAR image classification, calculate the concealment of the trigger according to formula (6); calculate the test accuracy of the poisoning model according to formula (12); use M poi For the poisoned test set X o-poied-valid Perform SAR image classification and calculate the poisoning model M according to formula (13) poi The attack success rate; using M clean For the clean test set X o-valid Perform SAR image classification and calculate the clean model M according to formula (14)clean Test accuracy:

[0046]

[0047]

[0048]

[0049] Among them, BA represents the test accuracy of the poisoned model, ASR represents the attack success rate of the poisoned model, CA represents the test accuracy of the clean model, and N true Indicates the number of correctly predicted clean SAR image samples, N all Indicates the total number of clean SAR image samples, N poi-true Indicates the number of correctly predicted SAR image samples with triggers, N poi-all Indicates the total number of SAR image samples with triggers.

[0050] The beneficial effects of the present invention are that it not only realizes for the first time the multi-objective automatic optimization design of the backdoor embedding trigger for the SAR image DNN classifier, while maintaining the high concealment of the backdoor trigger, but also achieves an extremely high attack success rate using only a small number of backdoor samples, but also quantitatively evaluates the security risks and performance of the SAR image DNN classifier after the backdoor attack, providing support for the subsequent design of security defense technology for the SAR image DNN classifier. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of the principle of backdoor attack design and evaluation method for SAR image DNN classifier;

[0052] Figure 2 This is an example diagram of a randomly generated trigger, where the generated random noise matrix and zero-one matrix A mn The size of is 4×4 in the figure, η is the random noise matrix and the zero-one matrix A mn The triggers formed;

[0053] Figure 3 This is an example diagram of two 4×4 example parents performing cross calculations to generate offspring during the design of a multi-target backdoor attack trigger;

[0054] Figure 4 This is an example diagram of a 4×4 individual mutation operation in the design process of a multi-target backdoor attack trigger;

[0055] Figure 5This is a comparison of poisoned images using the technology of the present invention and the existing technologies of Backdoored Neural Network (BadNet), Blended Accessory Injection Strategy (Blended), Backdoor Signals (Sig), Warping-based Backdoor (WaNet) and Reflection Backdoor (Refool) on the SAR image AlexNet classifier;

[0056] Figure 6 This is a comparison chart of the test accuracy CA of the technology of the present invention and the existing technologies BadNet, Blended, Sig, WaNet and Refool on the SAR image AlexNet classifier;

[0057] Figure 7 This is a comparison chart of the L2 distance between the technology of the present invention and the existing technologies BadNet, Blended, Sig, WaNet and Refool on the SAR image AlexNet classifier;

[0058] Figure 8 This is an ASR comparison chart of the attack success rate of the technology of the present invention and the existing technologies BadNet, Blended, Sig, WaNet and Refool on the SAR image AlexNet classifier. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0060] The AlexNet classifier for SAR images of the Gaofen-3 satellite (a deep convolutional neural network (DNN) model named after the model designer Alex Krizhevsky) is used as an example. However, the DNN model used in the technology of the present invention is not limited to the AlexNet classification model, and can also be other types of DNN models.

[0061] See also Figure 1The backdoor attack design and evaluation system for the SAR image DNN classifier of the present invention includes a SAR (Synthetic Aperture Radar) image data acquisition module, a backdoor trigger multi-target offline optimization design module, and a backdoor attack embedding and performance evaluation module.

[0062] In this embodiment, the SAR image data acquisition module is used to obtain the center of the target to be detected based on the high-resolution images in the SAR historical database. The center of the smallest circumscribed eccentric circle of the target center is used as the midpoint, and the data is expanded outward by 128 pixels to obtain a SAR image slice dataset of size 256 pixels × 256 pixels. The image slice dataset is normalized and labeled, and divided into a clean training set, a clean validation set, and a dataset to be poisoned. The clean training set, clean validation set, and dataset to be poisoned serve as input to the backdoor trigger multi-objective offline optimization design module. At the same time, the dataset to be poisoned serves as input to the backdoor attack embedding and performance evaluation module.

[0063] In this embodiment, the backdoor trigger multi-objective offline optimization design module is used to obtain a compromise optimal trigger design scheme that takes into account both high concealment and high attack success rate based on the multi-objective backdoor trigger optimization solver, and transmit the optimal trigger design scheme to the backdoor attack embedding and performance evaluation module.

[0064] In this embodiment, the backdoor attack embedding and performance evaluation module is used to inject the optimal backdoor trigger into the dataset to be poisoned to form a poisoned dataset, merge the clean training set and the poisoned dataset to obtain the backdoor attack dataset, train the SAR image DNN classification model on the backdoor attack dataset to obtain a poisoned model embedded with the backdoor, make the poisoned model output the trigger-specified operation, and evaluate the test accuracy, backdoor concealment, and attack success rate of the clean model and the poisoned model.

[0065] It is worth mentioning that an embodiment of the present invention further provides a backdoor attack design and evaluation method for a SAR image DNN classifier, which applies the backdoor attack design and evaluation system for a SAR image DNN classifier described in the above embodiment.

[0066] See also Figure 1 , the method specifically comprises the following steps:

[0067] (1) Dataset acquisition and preprocessing. The data acquisition module of SAR image detection obtains the center of the target to be detected, slices the image, and labels the category of the high-resolution image produced by the Gaofen-3 satellite to obtain the source data set X. The size of each image is scaled to 256 pixels × 256 pixels, and the data is normalized according to formula (1) to obtain the clean data set X. o , X oSplit in a ratio of 4:1:1 to obtain a clean training set X o-train , clean validation set X o-valid and the dataset to be poisoned X o-poi ;

[0068]

[0069] Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j represents the feature of the j-th dimension of the source dataset X, and d represents X o The maximum value of the dimension.

[0070] (2) Set the parameter values ​​of the backdoor trigger multi-objective offline optimization design module. The parameter values ​​include the standard deviation of the generated Gaussian noise Std = 0.3, the number of perturbations selected from the Gaussian noise B k =100, the neural network model Model is the classic neural network AlexNet (a deep convolutional neural network named after the model designer Alex Krizhevsky), the DNN model training round Epoch = 30, the DNN model training learning rate Lr = 0.001, the population size N = 30, the number of iterative optimizations for trigger design optimization I = 25, the crossover rate σ = 0.7, the mutation rate θ = 0.1, and the number of regions N into which the trigger is divided during adaptive mutation. r =256, number of mutation pixels B m =50 and the cumulative probability of mutation is updated at interval generation Ng=5.

[0071] (3) Initialize N individuals as the initial population Q. Each individual represents a trigger design, and its encoding form is x i =[A mn ,ε], where A is a zero-one matrix with m rows and n columns, m and n are the width and height of the input SAR image, i.e. 256 and 256 respectively. The number of elements in A that are 1 is B k =100, ε is a random noise matrix with a standard deviation of Std that conforms to the Gaussian distribution, and the dimension of the matrix is ​​m rows and n columns.

[0072] In this embodiment, the encoding information corresponding to a randomly generated individual of size 4×4 is as follows: Figure 2 , which shows the process of generating triggers based on the encoded information.

[0073] (4) Evaluate the performance of the population Q. Based on the information represented by each individual in Q, generate a backdoor trigger η according to formula (2), and inject the backdoor trigger η into the poisoned dataset X in the form of formula (3). o-poi, and modify its corresponding real type to the type that the attacker wants the model to output, and obtain the poisoned dataset X o-poied ; poisoned dataset X o-poied Divide into poisoned training set X according to the ratio of 5:4 o-poied-train and the poisoned test set X o-poied-valid , the poisoned training set X o-poied-train and clean training set X o-train Merge to generate backdoor dataset X o-back , X o-back As the data input of the DNN model Model, Epoch=30 rounds of training are performed to generate the poisoned model. The poisoned model is tested on the clean validation set X o-valid and the poisoned test set X o-poied-valid Test on the clean validation set X and calculate the o-valid and the poisoned test set X o-poied-valid The target values ​​f1 and f2 on X, where f1 represents the DNN model o-valid The prediction error on X is represented by f2, which indicates the DNN model’s o-poied-valid The prediction error on is used to calculate the concealment f3 of the backdoor trigger according to formula (6), where f3 represents the Euclidean distance between the poisoned image and the clean image.

[0074] η=A mn ×ε (2)

[0075] X o_poied =X o_poi (1-A mn )+η (3)

[0076]

[0077] Among them, N clean_err For X o-valid The number of samples with incorrect predictions, N clean_all For X o-valid The total number of samples.

[0078]

[0079] Among them, N poi_err For X o-poied-valid The number of samples with incorrect predictions, N poi_all For X o-poied-valid The total number of samples.

[0080]

[0081] Where P is the poisoned image, X is the clean image, r is the row size of the SAR image 256, and c is the column size of the SAR image 256.

[0082] (5) Count the f1 value, f2 value and f3 value of each individual in the population Q. If the individual x i The f1 value, f2 value and f3 value of the individual x are all smaller than those of the individual x. j The f1 value, f2 value and f3 value of individual x are called i Disposable individuals x j ; Individual x j The number of dominated individuals n j At the same time as adding 1, the individual x j Join individual x i Dominated individual set s i Compare the dominance between individuals to obtain the number of dominated individuals n and the dominance set s of each individual; find individuals whose n is 0 in the population and save them in the set F1; traverse the set s dominated by each individual in F1, and perform n on each individual g in s g =n g -1, if n exists g = 0, add it to the set F2; repeat the above operation on F2 until the entire population Q is divided into sets F of different levels.

[0083] (6) For the population Q that has been ranked by dominance, for each level set F k , where 1≤k≤N, sort in ascending order according to f1 value, f2 value and f3 value respectively, and calculate F k Each individual M in the network is calculated according to formula (7).

[0084]

[0085] Among them, M d represents the crowding degree of individual M, f l M+1 represents the target value f of individual M+1 l , f l M-1 represents the target value f of individual M-1 l .

[0086] (7) According to the binary bidding competition method, two individuals are selected from the population Q as parent individuals, and a floating point number e1 between 0 and 1 is randomly generated. The relationship between e1 and the crossover rate σ is determined. If e1>σ, then there is no need for crossover between the parent individuals; otherwise, the two parent individuals are marked as and x 1 and x 2 Generate trigger η according to formula (2) 1 and η2 Randomly generate a zero-one matrix B of size m×n (i.e. 256×256), and implement the crossover operation between the two parent individuals according to formula (8) to obtain two offspring individuals, which are marked as c and 1 and c 2 ;

[0087]

[0088] The offspring c 1 and c 2 Store it in the new population set P, and repeat the above operation until the size of the set P is equal to the size of the population Q. For example, the process of crossover calculation between two 4×4 parent generations to generate offspring is as follows: Figure 3 shown.

[0089] (8) Traverse all individuals in the new population P and perform mutation operations on their corresponding triggers η; o-back The image is divided into N r = 256 regions of the same size, the pixels in each region share the same importance, and a random initial mutation probability P is set for each region mua The pixel area location of each individual mutation is selected based on the different mutation probabilities of each area using the roulette wheel selection method. When an individual mutates, the number of successful or failed mutations is recorded. Success means that the f2 value of the mutated offspring is smaller than that of the parent, while failure means the opposite. g After generations, the mutation probability P of each region is calculated according to formula (9) and formula (10). mua To update:

[0090]

[0091] Among them, S all represents the sum of all successful mutations, S h represents the number of successful mutations in the hth region;

[0092]

[0093] in, represents the mutation probability P of the hth region after update mua .

[0094] Select a parent x from the population i , randomly generate a floating point number e2 between 0 and 1, and judge the relationship between e2 and mutation rate θ. If e2>θ, the individual does not need to mutate; otherwise, generate a zero-one matrix B2 with the same dimension as the SAR image, in which the position of element 1 is based on the mutation probability Choose B by roulette m According to formula (11), the individuals are mutated; the population after the mutation operation is marked as P M ,like Figure 4 As shown, a schematic diagram of a 4×4 parent generation performing a mutation operation to generate offspring is given.

[0095] c i =x i ×(1-B2)+η×B2 (11)

[0096] (9) Merge population P and population Q to obtain population R. Evaluate the target values ​​of f1, f2, and f3 for population R according to the performance evaluation method described in step (4). Perform non-dominated sorting on population R according to step (5). Calculate the crowding degree of the non-dominated sorted population R according to step (6). In each set F, sort the individuals from small to large according to the crowding degree. Select the first N individuals of the sorted population R to form the new offspring population Q. n .

[0097] (10) Unconditionally accept Q = Q n .

[0098] (11) Repeat steps (4) to (10) until the set number of iterative optimization times I is met.

[0099] (12) The individual with the smallest crowding degree in the F1 set finally obtained in the offline optimization training module is taken as the optimal individual X best , according to X best The characterized trigger set design information obtains the optimal backdoor trigger in the SAR image classification model Model.

[0100] (13) According to the method of formula (2), the backdoor trigger is generated according to the optimal backdoor trigger encoding information obtained in step (12), and it is applied to the poisoned data set X according to the method of step (4). o-poi Generate backdoor dataset X o-back , poisoned test set X o-poied-valid .

[0101] (14) In the clean training set X o-train Train the DNN model Model to get the clean model M clean , in the backdoor dataset X o-back Train the DNN model Model to get the poisoned model M embedded with the backdoor poi .

[0102] (15) Using M poi For the validation set X o-validPerform SAR image classification and calculate the trigger concealment (labeled as L2) according to formula (6); calculate the test accuracy of the poisoning model (labeled as BA) according to formula (12); use M poi For the poisoned test set X o-poied-valid Perform SAR image classification and calculate the poisoning model M according to formula (13) poi The attack success rate (marked as ASR); using M clean For the clean test set X o-valid Perform SAR image classification and calculate the clean model M according to formula (14) clean The closer BA and CA are, the larger ASR is, which means the backdoor trigger is more effective; if L2 is smaller, the backdoor trigger is more hidden;

[0103]

[0104]

[0105]

[0106] Among them, N true Indicates the number of correctly predicted clean SAR image samples, N all Indicates the total number of clean SAR image samples, N poi-true Indicates the number of correctly predicted SAR image samples with triggers, N poi-all Represents the total number of SAR image samples with triggers. In this embodiment, the clean model's test accuracy (CA) achieved by the present invention is 78.47%. The attack success rate (ASR) and test accuracy (BA) of the poisoned model embedded with the backdoor are 100% and 77.08%, respectively. L2, which measures the stealth of the backdoor trigger, is 1.26.

[0107] The technology of the present invention is used to compare and analyze the experimental results of the above embodiments with the existing technologies of backdoored neural network (Backdoored Neural Network, marked as BadNet), blended accessory injection strategy (Blended), backdoor signals (BackdoorSignals, marked as Sig), warping-based backdoor (WaNet) and reflection backdoor (ReflectionBackdoor, marked as Refool). The comparison of poisoned images is shown in the figure below. Figure 5 As shown in the BA comparison chart Figure 6 As shown, the L2 comparison chart is as follows Figure 7 As shown in the ASR comparison chart, Figure 8 As shown. Figures 6 to 8 By comparison, it is not difficult to find that: compared with existing technologies such as BadNet, Blended, Sig, WaNet and Refool, the CA and L2 performance indicators obtained by the technology of the present invention are the best, and the attack success rate reaches 100%. This means that the technology of the present invention can achieve an extremely high attack success rate by using only a small number of backdoor samples while maintaining the high concealment of the backdoor trigger and maintaining the original performance loss of the DNN model. In addition, it should be noted that the existing technologies BadNet, Blended, Sig, WaNet and Refool were all backdoor attack methods proposed for the traditional natural image field. Therefore, this patented technology is the first to realize the multi-objective automatic optimization design of the backdoor embedding trigger for the SAR image DNN classifier.

[0108] As described in the summary, the beneficial effects of this patent are: this patent not only realizes the multi-objective automatic optimization design of the backdoor embedding trigger for the SAR image DNN classifier for the first time, while maintaining the high concealment of the backdoor trigger, it can achieve an extremely high attack success rate using only a small number of backdoor samples, and it also quantitatively evaluates the security risks and performance of the SAR image DNN classifier after facing backdoor attacks, providing support for the subsequent design of security defense technology for SAR image DNN classifiers.

[0109] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A backdoor attack design and evaluation method for SAR image DNN classifier, characterized by: The method is used to quantitatively evaluate the security risks and performance of a SAR image DNN classifier after a backdoor attack, thereby providing support for the design of security defense technology for the SAR image DNN classifier. The method comprises the following steps: (1) The SAR image data acquisition module obtains the center of the target to be detected, slices the image, and labels the category of the SAR high-resolution image to obtain the source data set X. The size of each image is scaled to 256 pixels × 256 pixels, and the data is normalized according to formula (1) to obtain the clean data set X. o , X o Split in a ratio of 4:1:1 to obtain a clean training set X o-train , clean validation set X o-valid and the dataset to be poisoned X o-poi : Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j represents the feature of the j-th dimension of the source dataset X, and d represents X o The maximum value of the dimension; (2) Setting the parameter values ​​of the backdoor trigger multi-objective offline optimization design module, the parameter values ​​include the standard deviation Std of the generated Gaussian noise, the number of disturbance sizes B selected from the Gaussian noise, and the number of perturbations. k , DNN model Model, DNN model training round Epoch, DNN model training learning rate Lr, population size N, trigger design optimization iteration number I, crossover rate σ, mutation rate θ, the number of regions the trigger is divided into during adaptive mutation N r , the number of mutation pixels B m and mutation cumulative probability update interval generation N g ; (3) Initialize N individuals as the initial population Q: Each individual represents a trigger design, and its encoding form is x i =[A mn ,ε], where A is a zero-one matrix with m rows and n columns, m and n are the width and height of the input SAR image respectively, and the number of elements in A that are 1 is B k , ε is a random noise matrix with a Gaussian distribution and a standard deviation of Std. The dimension of the matrix is ​​m rows and n columns; (4) Performance evaluation of population Q: Based on the information represented by each individual in Q, generate a backdoor trigger η according to formula (2), and inject the backdoor trigger η into the poisoned dataset X in the form of formula (3). o-poi , and modify its corresponding real type to the type that the attacker wants the model to output, and obtain the poisoned dataset X o-poied ; poisoned dataset X o-poied Divide into poisoned training set X according to the ratio of 5:4 o-poied-train and the poisoned test set X o-poied-valid , the poisoned training set X o-poied-train and clean training set X o-train Merge to generate backdoor dataset X o-back , X o-back As the data input of the DNN model Model, the Epoch round of training is carried out to generate a poisoned model. The poisoned model is tested on the clean validation set X o-valid and the poisoned test set X o-poied-valid Test on the clean validation set X and calculate the o-valid and the poisoned test set X o-poied-valid The target values ​​f1 and f2 on X, where f1 represents the DNN model o-valid The prediction error on X is represented by f2, which indicates the DNN model’s o-poied-valid The prediction error on , the concealment f3 of the backdoor trigger is calculated according to formula (6), where f3 represents the Euclidean distance between the poisoned image and the clean image; n = A mn ×e (2) X o_poied =X o_poi (1-A mn )+η (3) Among them, N clean _ err For X o-valid The number of samples with incorrect predictions, N clean_all For X o-valid The total number of samples; Among them, N poi _ err For X o-poied-valid The number of samples with incorrect predictions, N poi_all For X o-poied-valid The total number of samples; Where P is the poisoned image, X is the clean image, r is the row size of the SAR image, and c is the column size of the SAR image; (5) Count the f1 value, f2 value and f3 value of each individual in population Q. If individual x i The f1 value, f2 value and f3 value of the individual x are all smaller than those of the individual x. j The f1 value, f2 value and f3 value of individual x are called i Disposable individuals x j ; Individual x j The number of dominated individuals n j At the same time as adding 1, the individual x j Join individual x i Dominated individual set s i Compare the dominance between individuals to obtain the number of dominated individuals n and the dominance set s of each individual; find individuals whose n is 0 in the population and save them in the set F1; traverse the set s dominated by each individual in F1, and perform n on each individual g in s g =n g -1, if n exists g = 0, add it to the set F2; repeat the above operation on F2 until the entire population Q is divided into sets F of different levels; (6) For the population Q that has been ranked by dominance, for each level set F k , where 1≤k≤N, sort in ascending order according to f1 value, f2 value and f3 value respectively, and calculate F k The congestion degree of each individual M in is calculated according to formula (7): Among them, M d represents the crowding degree of individual M, f l M+1 represents the target value f of individual M+1 l , f l M-1 represents the target value f of individual M-1 l ; (7) According to the binary bidding competition method, two individuals are selected from the population Q as parent individuals, and a floating point number e1 between 0 and 1 is randomly generated. The relationship between e1 and the crossover rate σ is determined. If e1>σ, then there is no need for crossover between the parent individuals; otherwise, the two parent individuals are marked as and x 1 and x 2 According to formula (2), η is generated 1 and η 2 ; Randomly generate a zero-one matrix B of size m×n, implement the crossover operation between the two parent individuals according to formula (8), and obtain two offspring individuals, marked as c 1 and c 2 ; The offspring c 1 and c 2 Store it in the new population set P and repeat the above operation until the size of set P is equal to the size of population Q; (8) Traverse all individuals in the new population P and perform mutation operations on their corresponding triggers η; o-back The image is divided into N r There are regions of the same size, the pixels in each region share the same importance, and a random initial mutation probability P is set for each region. mua The pixel area position of each individual mutation is selected according to the different mutation probabilities of each area using the roulette wheel selection method. When an individual mutates, the number of successful or failed mutations is recorded. Success means that the f2 value of the mutated offspring is smaller than that of the parent, while failure means the opposite. g After generations, the mutation probability P of each region is calculated according to formula (9) and formula (10). mua To update: Among them, S all represents the sum of all successful mutations, S h represents the number of successful mutations in the hth region; in, represents the mutation probability P of the jth region after update mua ; Select a parent x from the population i , randomly generate a floating point number e2 between 0 and 1, and judge the relationship between e2 and mutation rate θ. If e2>θ, the individual does not need to mutate; otherwise, generate a zero-one matrix B2 with the same dimension as the SAR image, in which the position of element 1 is based on the mutation probability Choose B by roulette m According to formula (11), the individuals are mutated; the population after the mutation operation is marked as P M ; c i =x i ×(1-B2)+η×B2 (11) (9) The population P M Merge with population Q to obtain population R. According to the performance evaluation method described in step (4), evaluate the target values ​​of f1, f2 and f3 for population R. According to step (5), perform non-dominated sorting on population R. According to step (6), calculate the crowding degree of the non-dominated sorted population R. In each set F, sort them from small to large according to the crowding degree. Select the first N individuals of the sorted population R to form the new offspring population Q. n ; (10) Unconditionally accept Q = Q n ; (11) Repeat steps (4) to (10) until the set number of iterative optimization times I is met; (12) The individual with the smallest crowding degree in the final F1 set is taken as the optimal individual X best , to obtain the optimal backdoor trigger in the SAR image DNN classification model; (13) According to the method of formula (2), a backdoor trigger is generated according to the optimal backdoor trigger encoding information obtained in step (12), and it is applied to the poisoned data set X according to the method of step (4). o-poi Generate backdoor dataset X o-back , poisoned test set X o-poied-valid ; (14) In the clean training set X o-train Train the DNN model Model to obtain the clean model M clean , in the backdoor dataset X o-back Train the DNN model Model to obtain the poisoned model M embedded with the backdoor poi ; (15) Using M poi For the validation set X o-valid Perform SAR image classification, calculate the concealment of the trigger according to formula (6); calculate the test accuracy of the poisoning model according to formula (12); use M poi For the poisoned test set X o-poied-valid Perform SAR image classification and calculate the poisoning model M according to formula (13) poi The attack success rate; using M clean For the clean test set X o-valid Perform SAR image classification and calculate the clean model M according to formula (14) clean Test accuracy: Among them, BA represents the test accuracy of the poisoned model, ASR represents the attack success rate of the poisoned model, CA represents the test accuracy of the clean model, and N true Indicates the number of correctly predicted clean SAR image samples, N all Indicates the total number of clean SAR image samples, N poi-true Indicates the number of correctly predicted SAR image samples with triggers, N poi-all Indicates the total number of SAR image samples with triggers.

2. A backdoor attack design and evaluation system for a SAR image DNN classifier for implementing the method according to any one of claim 1, characterized in that: The system is used to quantitatively evaluate the security risks and performance of SAR image DNN classifiers after backdoor attacks, providing support for the design of security defense technologies for SAR image DNN classifiers. The system includes a SAR image data acquisition module, a backdoor trigger multi-objective offline optimization design module, and a backdoor attack embedding and performance evaluation module. The SAR image data acquisition module is used to obtain the center of the target to be detected based on the high-resolution image of the SAR historical database, expand 128 pixels outward from the center of the minimum circumscribed eccentric circle of the target center as the midpoint, and obtain a SAR image slice data set of size 256 pixels × 256 pixels. The image slice data set is normalized and labeled, and divided into a clean training set, a clean validation set, and a data set to be poisoned. The clean training set, clean validation set, and data set to be poisoned are used as inputs to the backdoor trigger multi-objective offline optimization design module; at the same time, the data set to be poisoned is used as input to the backdoor attack embedding and performance evaluation module. The backdoor trigger multi-objective offline optimization design module is used to obtain the optimal trigger design solution based on the multi-objective backdoor trigger optimization solver, and transmit the optimal trigger design solution to the backdoor attack embedding and performance evaluation module; The backdoor attack embedding and performance evaluation module is used to inject the optimal backdoor trigger into the data set to be poisoned to form a poisoned data set, merge the clean training set and the poisoned data set to obtain a backdoor attack data set, train the SAR image DNN classification model on the backdoor attack data set to obtain a poisoned model embedded with a backdoor, make the poisoned model output the trigger-specified operation, and evaluate the test accuracy, backdoor concealment, and attack success rate of the clean model and the poisoned model.

Images