Backdoor attack countermeasure method and system for secure migration of artificial intelligence models

Abstract

The present invention discloses a backdoor attack countermeasure method and system for the security of artificial intelligence model migration. The present invention is based on the optimization of the knowledge distillation migration paradigm to resist the transfer of backdoor attack trigger patterns; wherein the student model does not directly imitate the output of the teacher model, but uses the Transformer to perform inter-layer fusion of the student model output and then matches and learns the teacher model output in a global interactive information mode. The information of the teacher model is dispersed and disassembled into the parameter weights of each stage of the student model by the fused information, which can prevent the student model from being affected by the local information-based attack backdoor contained in the teacher model. At the same time, global information fusion can improve the semantics learned by the student model, thereby improving accuracy. The method provided by the present invention can obtain a safe student model that can remove the local information-based attack backdoor when migrating the capabilities of artificial intelligence models from untrusted sources.

Description

Technical Field

[0001] The present invention belongs to the field of network information security technology and relates to a backdoor attack countermeasure method and system for artificial intelligence model migration security. Background Art

[0002] With the continuous development of neural network artificial intelligence (AI) models, they are gradually playing an increasingly important role in our daily lives. For end users who lack powerful computing resources and supporting datasets, they can download pre-trained models from the internet and fine-tune them in their desired domain (He T, Zhang Z, Zhang H, et al. Bagof tricks for image classification with convolutional neural networks[C] / / Proceedings of the IEEE / CVF conference on Computer Vision and Pattern Recognition(CVPR).2019:558-567.) or apply AI models through distillation transfer (Hinton G, Vinyals O, Dean J. Distilling the knowledge in a neural network[J].arXiv preprint arXiv:1503.02531,2015.). AI models obtained through these methods can achieve excellent generalization performance, achieve a selected model size, reduce computational costs, and provide good specialized performance in the user's desired domain.

[0003] However, pre-trained models on the internet have the potential to be inadvertently trained with backdoors and Trojans. Pre-trained models trained in a specific manner can exhibit attacker-defined behaviors when encountering specific characteristic patterns, such as performance degradation, targeted sabotage, and incorrect decision-making. Backdoor attacks on AI models are highly targeted, and when backdoor triggers are present in the AI model's application scenario, unexpected errors can occur (Liu Y, Wen R, He X, et al. {ML-Doctor}: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models[C] / / 31st USENIX Security Symposium (USENIX Security 22). 2022:4525-4542.). In addition to attackers directly releasing backdoored models, download links for some pre-trained models published on legitimate websites can also be hijacked, allowing dangerous models to be delivered to end users for attack purposes. Therefore, AI models downloaded from the internet require certain processing before they can be used safely.

[0004] Currently, using an optimized knowledge distillation paradigm to process attacked models is one of the effective means to combat backdoor attacks on artificial intelligence models (Wang H, Deng Y, Yoo S, et al. AGKD-BML: Defense against adversarial attack by attention guided knowledge distillation and bi-directional metric learning[C] / / Proceedings of the IEEE / CVF International Conference on Computer Vision(ICCV).2021:7658-7667.). Existing technical solutions mainly perform matching learning on the output feature pixels, performing some processing during learning to reduce the possibility of backdoor transmission. The advantage of this method is that it can perform pixel-by-pixel overall resistance learning on untrusted models, which helps to remove trigger patterns that are effective globally. However, it is not very effective in protecting against backdoor attacks that use small-scale local semantic information as triggers.

[0005] Among the backdoor attack defense methods, there are technical solutions that add disturbance information to the model input and observe the amplitude of feature changes. If the amplitude of change exceeds the mean of the model weight under the same small disturbance, it is considered an unstable weight (Kim J, Lee BK, Ro Y M. Distilling robust and non-robust features in adversarial examples by information bottleneck [J]. Advances in Neural Information Processing Systems, (NIPS) 2021, 34: 17148-17159.); using this method, unstable and sensitive features can be judged at the feature level and shielded, but since these sensitive features are also important features for model accuracy, simple shielding will lead to a significant decrease in model accuracy. Summary of the Invention

[0006] In response to the problems existing in the prior art, the purpose of the present invention is to provide a backdoor attack countermeasure method and system for the security of artificial intelligence model migration.

[0007] 1. To combat the potential backdoor attack trigger patterns based on local information during knowledge transfer learning in neural network preprocessing models, this paper proposes a method to resist backdoor attacks by using the Transformer to fuse information between the output layers of each stage of the training model. The Transformer model is a global interactive model with strong long-term information memory capabilities, built around a self-attention mechanism (Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need [J]. Advances in Neural Information Processing Systems (NIPS), 2017, 30). Each block within the Transformer interacts with other blocks to determine the weight of each block's influence on the rest of the world. Therefore, the Transformer can be applied to knowledge distillation to strengthen the interaction between feature layers, allowing each feature layer to access information from other feature layers, thereby achieving global semantic information interaction and fusion. This fusion and learning can then be used to resist backdoor attacks based on local semantic information.

[0008] 2. In order to resist the performance degradation of the training model to be learned that may be caused by backdoor attacks, the present invention proposes to use the self-attention mechanism to strengthen the semantic concentration of the student model's own network weights, which can improve the ability to learn during the distillation and migration process of the neural network pre-training model.

[0009] 3. In order to address the problem that the information capacity and density at each stage in the distillation and migration process of the neural network pre-training model are different but have the same impact on the training process, the present invention proposes an inter-level adaptive distillation and migration weighting method, which can balance the learning intensity of the information between the deep-level strong semantic small-capacity feature map and the shallow-level weak semantic large-capacity feature map, thereby improving the accuracy of the training model to be learned.

[0010] To achieve the above objectives, the present invention is implemented through the following technical solutions: a backdoor attack countermeasure method for the security of artificial intelligence model migration, comprising the following steps:

[0011] (1) Select and initialize the large model corresponding to the upper-level application task of the target application task as the teacher model M tea For example, when the target application task is a computer vision downstream task such as dense small target detection or multi-instance small target segmentation, the upper-level application task is generally an image classification task. In this case, the so-called large model can refer to an image classification neural network model such as BASIC-L, ViT-e, etc. that uses large-scale data sets for training and has a large number of parameters; download and use the teacher model M stored on the public platform tea Incompletely trusted pre-trained weight pair M tea The initialized parameter weights are overwritten, and after the overwriting is completed, the teacher model M is fixed tea Parameter weights in; select and initialize the number of output layers and M tea A consistent small model or a teacher model M tea The same model as the student model M stu , initialize the Transformer model as the inter-layer information fusion framework model of the student model output features;

[0012] (2) Input the target domain dataset into the teacher model and the student model respectively, obtain the feature map at the intermediate level of each stage, and generate a student feature map set Feats containing all the output feature maps of each stage stu Feats tea , and the output of the last layer of the network before the output of the two models, that is, the model probability distribution Logits stu with Logits tea ;

[0013] (3) Feats stu Each feature map in the feature map is processed into a small feature block of the same size, that is, the length and width of the feature map are convolved to obtain consistent channels and sizes for feature map connection. At the same time, the feature map can be reduced to reduce the amount of calculation. In addition, the probability distribution Logits stuConvolution is performed to maintain consistent channels with the convolved feature map and combined together to input into TransformerEncoder. The self-attention mechanism is used to interactively fuse the input information of different levels and output the feature map set Feats after the global level information fusion. merge and the probability distribution Logits after fusion of feature map information merge , Feats merge with Logits merge At this time, it is saved in the hidden layer of TransformerEncoder;

[0014] (4) Feats merge with Logits merge The data are input into TransformerDecoder for decoding. Several feature blocks and a probability distribution corresponding to the input position are obtained in the order of input to TransformerEncoder. The convolution layer is used to restore the number of channels for the feature maps of each level in turn, and then the interpolation function is used to restore them to Feats one by one. stu The size of the original output feature map is restored to Logits using a fully connected layer for the probability distribution stu The number of channels is used to obtain the feature map set Feats after the information is globally semantically weighted by Transformer dec Weighted fusion probability distribution Logits with feature maps dec ;

[0015] (5) Feats of corresponding classes in turn tea and Feats dec and Logits tea and Logits dec Use the mean square error objective function to compare and calculate the loss, and logits stu The loss is calculated according to the target domain specific objective function; that is, for the student model M stu Each intermediate level l, using the feature map set Feats dec The feature map corresponding to the inner middle layer l and Feats tea The loss calculation is performed on the feature map corresponding to the inner middle layer l, and the probability distribution Logits dec and the probability distribution Logits tea Perform loss calculation to obtain the probability distribution loss value Logits loss , according to the loss value Feats corresponding to each intermediate level loss and the probability distribution loss value Logits loss The sum is calculated to get the distillation loss value Distill loss ; According to the Logits corresponding to each samplestu Calculate the loss value Custom with the true label of the sample loss ;

[0016] (6) According to the distillation loss value Distill loss and loss value Custom loss The calculated total loss is Total loss After calculating the gradient according to the optimization function, the training is repeated iteratively, and steps (2) to (6) are repeated until the student model converges. stu In imitating the teacher model M tea In the process, the global information interaction and fusion of the feature map information and the probability distribution before output are carried out to avoid the one-to-one matching learning teacher model M. tea The local information in the , thus avoiding learning the backdoor trigger feature pattern based on local information, and thus removing the potential backdoor to obtain a secure student model M stu .

[0017] Furthermore, in the above step (1), the download platform of the pre-trained model of the established model selects an open source or commercial pre-trained model weight providing platform, but its training data source, training method, and training parameters are regarded as model weights from untrusted sources for subsequent processing; the student model M stu The model capability is equal to or weaker than the teacher model M tea .

[0018] Furthermore, the target domain dataset in step (2) is the student model M stu The dataset that the user will use is organized by the user himself and is therefore considered a trusted dataset. It is weaker in scale and annotation accuracy than the dataset used by the pre-trained model.

[0019] The intermediate layers of each stage of the model refer to the relatively obvious reusable paradigms in the neural network model processing flow. The final output of each reusable paradigm is extracted as the output of a layer to obtain the full performance of the reusable paradigm while reducing the total amount of feature maps to speed up calculations.

[0020] The feature map set Feats stu With Feats tea Each has different shapes at different levels, that is, they differ in the number of channels, feature width, and feature length, and cannot be directly calculated.

[0021] The final output probability distribution Logits stu with Logits tea It is the estimated value of the correct probability of each type of neural network model before outputting the final result.

[0022] Furthermore, the feature blocks processed into the same size in the above step (3) are obtained by processing the output of convolutional layers with different sizes of convolution kernels and different step sizes in each layer. The feature maps of different levels will be aligned to the same number of channels and the same size to be input into TransformerEncoder for processing.

[0023] For Logits stu The processing is to use the fully connected layer to align the dimension to the features of the rest of the layers Figure 1 The same number of channels.

[0024] The TransformerEncoder's self-attention mechanism is a mechanism for weighting multiple targets to obtain weights. Its formula is as follows:

[0025]

[0026] When used as a self-attention mechanism, Q, K, and V are all initialized to the same value, which is each feature block in the present invention, d k is the number of channels, which is used to control the model scale.

[0027] In order to improve the computing speed, the present invention uses a multi-head attention mechanism to accelerate the calculation. Multi-head attention can use the parallel computing power of the graphics computing unit to perform calculations and thus obtain acceleration. The formula is as follows:

[0028] MultiHeadAttention(Q,K,V)=Concat(head1,…,head h )W O

[0029] wherehead i =Attention(QW i Q ,KW i K ,VW i V )

[0030] Among them, the projection weight is the parameter matrix

[0031] The size and number of feature blocks after TransformerEncoder processing are consistent with those when input to TransformerEncoder. merge with Logits merge That is, the feature block corresponding to the position of the original input feature block after processing.

[0032] Furthermore, the TransformerDecoder in step (4) is basically the same as the TransformerEncoder in structure, and its purpose is to decode the encoded global information and obtain weighted weights to perform global semantic interaction weighting on each feature block;

[0033] and Feats merge with Logits merge Similarly, the size and number of feature blocks after TransformerDecoder processing are the same as before, Feats dec with Logits dec That is, the feature block corresponding to the original input position after processing.

[0034] Furthermore, the convolution layer in step (5) has a convolution kernel size of 1x1 and a step size of 1, and the convolution layer is used to perform channel transformation to further exchange global information;

[0035] The interpolation function is used to restore the scaled feature map to its original size, and its interpolation algorithm is determined by the selected interpolation mode;

[0036] The mean square error objective function is one of the commonly used objective functions in the field of artificial intelligence. It is used to match different features. The loss formulas for each part are as follows:

[0037]

[0038]

[0039] Distill loss =Feats loss +Logits loss Where C, H, W represent the number of channels and the scale of the horizontal and vertical directions of the feature map, L represents the total number of reusable paradigm feature layers, N represents the number of training data, Feats dec [i][l](c,x,y) is the feature pixel at the (x,y)th position in the l-th layer feature map corresponding to the i-th sample obtained by decoding, Feats tea [i][l](c,x,y) is the feature pixel at the (x,y)th position in the l-th layer feature map of the i-th sample output by the teacher model, Logits dec [i] is the probability distribution corresponding to the i-th sample obtained by decoding, Logits tea [i] is the probability distribution of the i-th sample output by the teacher model; λ lIt is an optional parameter that can set the proportion of feature loss at different layers in the total loss. The parameter is calculated based on the importance of the information. The calculation method is the inverse of the ratio of the product of the size and channel of each feature map to its total.

[0040] For Logits stu The calculation of the original objective function refers to the objective function that the user applies to the field he needs, that is, Custom loss , the loss is defined and calculated by the user.

[0041] Furthermore, the weighted parameters in step (6) include the weight parameters λ of each level defined and used in step (5). l The loss α that controls the ratio of the distillation part to the original target loss is as follows:

[0042] Total loss =α×Distill loss +Custom loss

[0043] The backpropagation training student model refers to a method of optimizing the model using an error backpropagation optimization algorithm, and the selected optimization function can be defined by the user.

[0044] By student model M stu In imitating the teacher model M tea In the process, the global information interaction and fusion of the feature map information and the probability distribution before output are carried out to avoid the one-to-one matching learning teacher model M. tea The local information in the , thus avoiding learning the backdoor trigger feature pattern based on local information, and thus removing the potential backdoor to obtain a secure student model M stu .

[0045] The present invention provides a backdoor attack resistance system for artificial intelligence model migration security, which is characterized by including a teacher model M tea , Student Model M stu And training module; wherein, a model corresponding to the upper application task of the target application task is selected and initialized as the teacher model M tea , obtain the teacher model M tea The pre-trained model weights are applied to the teacher model M tea The parameter weights are covered; select and initialize a model as the student model M stu ;

[0046] The teacher model M tea , which is used to process the samples in the input target domain dataset to obtain the feature map set Feats composed of the feature maps output by each intermediate layer of the teacher modeltea And the probability distribution Logits of the last layer output of the teacher model tea ;

[0047] The student model M stu , which is used to process the samples in the input target domain data set to obtain the feature map set Feats composed of the feature maps output by each intermediate level of the student model stu And get the probability distribution Logits of the last layer output of the student model stu ;

[0048] The training module is used to stu Each feature map in is processed into a feature block of set size, and the probability distribution Logits stu Processing makes its channel consistent with the channel of the feature block, and then the processed probability distribution Logits stu Combined with each of the feature blocks, they are input into the TransformerEncoder model, which uses the self-attention mechanism to interactively fuse the input information at different levels and outputs a feature map set Feats after the global level information is fused. merge and the probability distribution Logits after fusion of feature map information merge ; Then Feats merge with Logits merge The decoded feature maps are then restored to the Feats model one by one. stu The size and number of channels of the feature map in the decoded probability distribution are restored to Logits stu The number of channels is used to obtain the global semantically weighted feature map set Feats dec Weighted fusion probability distribution Logits with feature maps dec ; Then for the student model M stu Each intermediate level l, using the feature map set Feats dec The feature map corresponding to the inner middle layer l and Feats tea The loss calculation is performed on the feature map corresponding to the inner middle layer l, and the probability distribution Logits dec With Teacher Model M tea Output probability distribution Logits tea Perform loss calculation to obtain the probability distribution loss value Logits loss , according to the loss value Feats corresponding to each intermediate level loss and the probability distribution loss value Logitsloss The sum is calculated to get the distillation loss value Distill loss ; According to the Logits corresponding to each sample stu Calculate the loss value Custom with the true label of the sample loss ; Then according to the distillation loss value Distill loss and loss value Custom loss The calculated total loss is Total loss Optimize the student model M stu , until the student model M stu Convergence results in a security model that removes potential backdoors.

[0049] The present invention provides a server, characterized in that it includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the above method.

[0050] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0051] The advantages of the present invention are as follows:

[0052] 1. By using the Transformer structure to perform global semantic fusion on the outputs of each level of the neural network model that receives the transfer information, the present invention can avoid one-to-one learning of the teacher model's features at the pixel level, thereby effectively resisting backdoor attacks that use local semantic information patterns as triggers. At the same time, the distillation paradigm itself can also resist backdoor attack trigger patterns of global semantic information patterns.

[0053] 2. The present invention strengthens the semantic information fusion degree of the trained student model through the global semantic information fusion method, which can enhance the student model's ability to learn semantic information in the process of matching the teacher model, thereby improving the accuracy of the student model.

[0054] 3. The present invention uses an inter-level adaptive distillation transfer weighting method to balance the learning intensity of information between deep-level strong semantic small-capacity feature maps and shallow-level weak semantic large-capacity feature maps, thereby improving the accuracy of the trained student model.

[0055] 4. The present invention can obtain a high-precision student model that is resistant to backdoor attack modes in the user target domain based on the untrusted source pre-training model. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is an overview diagram of the backdoor attack countermeasure method and system for the security of artificial intelligence model migration according to the present invention.

[0057] Figure 2 This is a diagram briefly describing an embodiment of the backdoor attack countermeasure method and system for secure migration of artificial intelligence models according to the present invention. DETAILED DESCRIPTION

[0058] The present invention will be described in further detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0059] The embodiment of the present invention provides a backdoor attack countermeasure method for the security of artificial intelligence model migration, such as Figure 1 , Figure 2 shown.

[0060] In this embodiment, the teacher model used is ResNet110, the student model is ResNet20, the user dataset is CIFAR100, and the user application field is image classification. The following steps are included:

[0061] (1) Initialize the large teacher model ResNet110 as M tea , use the pre-trained model weights stored on the public platform to train the teacher model M tea After the overwriting is completed, the parameter weights in ResNet110 are fixed; ResNet20 is initialized as the student model M stu , initialize the Transformer model as the inter-layer information fusion framework model of the ResNet20 model output features;

[0062] (2) Input the target domain dataset into the teacher model and the student model respectively, obtain the feature map at the intermediate level of each stage, and generate a student feature map set Feats containing all the output feature maps of each stage stu Feats tea , and the output of the last layer of the network before the output of the two models, that is, the model probability distribution Logits stu with Logits tea ;

[0063] (3) Feats stu Each feature map in the feature map is processed into a small feature block of the same size, that is, the length and width of the feature map are convolved to obtain consistent channels and sizes for feature map connection. At the same time, the feature map can be reduced to reduce the amount of calculation. In addition, the probability distribution Logits stuConvolution is performed to maintain consistent channels with the convolved feature map and combined together to input into TransformerEncoder. The self-attention mechanism is used to interactively fuse the input feature map information of different levels and the probability distribution information, and output the global inter-layer fused feature map set Feats merge and the probability distribution Logits after fusion of feature map information merge , Feats merge with Logits merge At this time, it is saved in the hidden layer of TransformerEncoder;

[0064] (4) Feats merge with Logits merge The data are input into TransformerDecoder for decoding. Several feature blocks and a probability distribution corresponding to the input position are obtained in the order of input to TransformerEncoder. The convolution layer is used to restore the number of channels for the feature maps of each level in turn, and then the interpolation function is used to restore them to Feats one by one. stu The size of the original output feature map is restored to Logits using a fully connected layer for the probability distribution stu The number of channels is used to obtain the feature map set Feats after the information is globally semantically weighted by Transformer dec Weighted fusion probability distribution Logits with feature maps dec ;

[0065] (5) Feats of corresponding classes in turn tea and Feats dec and Logits tea and Logits dec Use the mean square error objective function to compare and calculate the loss, and logits stu Compute the loss according to the target domain specific objective function;

[0066] (6) The total loss is obtained by weighted summing of different losses and calculating the gradient according to the optimization function. Then the training is repeated iteratively and steps (2) to (6) are repeated until the student model converges. The student model M stu In imitating the teacher model M tea In the process, the global information interaction and fusion of the feature map information and the probability distribution before output are carried out to avoid the one-to-one matching learning teacher model M. tea The local information in the , thus avoiding learning the backdoor trigger feature pattern based on local information, and thus removing the potential backdoor to obtain a secure student model M stu .

[0067] Furthermore, in the above step (1), the download platform of the pre-trained model of the established model selects an open source or commercial pre-trained model weight providing platform, but its training data source, training method, and training parameters are regarded as model weights from untrusted sources for subsequent processing.

[0068] Furthermore, the student model M stu Different models can be selected in different application scenarios, but the model capabilities are equal to or weaker than the teacher model M tea ;

[0069] The key initialization parameters of Transformer are:

[0070] patch_size=7;

[0071] embed_dim=192;

[0072] depth=2;

[0073] num_heads = 3;

[0074] mlp_ratio=4;

[0075] qkv_bias=True.

[0076] Furthermore, the target domain dataset in step (2) is the student model M stu The dataset that the user will use is organized by the user and is therefore considered a trustworthy dataset. It is weaker in scale and annotation accuracy than the dataset used by the pre-trained model.

[0077] The intermediate layers of each stage of the model refer to the relatively obvious reusable paradigm in the neural network model processing flow. The final output of each reusable paradigm is extracted as the output of a layer to obtain the full performance of the reusable paradigm while reducing the total amount of feature maps to accelerate calculation. In this embodiment, the output feature sizes of ResNet110 are as follows from shallow to deep, and the output feature sizes of ResNet20 are the same as those of ResNet110:

[0078] in_channels=[16,16,32,64,64]

[0079] in_shapes = [32,32,16,8,1]

[0080] The final output probability distribution Logits stu with Logits tea It is the estimated value of the correct probability of each type of neural network model before outputting the final result.

[0081] Furthermore, the feature blocks processed into the same size in the above step (3) are obtained by processing the output of the convolution layers with different sizes of convolution kernels and different step sizes. The feature maps of different levels will be aligned to the same number of channels and the same size for input into TransformerEncoder for processing;

[0082] For Logits stu The processing is to use the fully connected layer to align the dimension to the features of the rest of the layers Figure 1 The number of channels;

[0083] The TransformerEncoder's self-attention mechanism is a mechanism for weighting multiple targets to obtain weights. Its formula is as follows:

[0084]

[0085] When used as a self-attention mechanism, Q, K, and V are all initialized to the same value, which is each feature block in this embodiment. k is the number of channels, used to control the model scale;

[0086] In order to improve the computing speed, the present invention uses a multi-head attention mechanism to accelerate the calculation. Multi-head attention can use the parallel computing power of the graphics computing unit to perform calculations and thus obtain acceleration. The formula is as follows:

[0087] MultiHeadAttention(Q,K,V)=Concat(head1,…,head h )W O

[0088] wherehead i =Attention(QW i Q ,KW i K ,VW i V )

[0089] Among them, the projection weight is the parameter matrix

[0090] The size and number of feature blocks after TransformerEncoder processing are consistent with those when input to TransformerEncoder. merge with Logits merge That is, the feature block corresponding to the position of the original input feature block after processing.

[0091] Furthermore, the TransformerDecoder in step (4) is basically the same as the TransformerEncoder in structure, and its purpose is to decode the encoded global information and obtain weighted weights to perform global semantic interaction weighting on each feature block;

[0092] and Feats merge with Logits merge Similarly, the size and number of feature blocks after TransformerDecoder processing are the same as before, Feats dec with Logits dec That is, the feature block corresponding to the original input position after processing.

[0093] Furthermore, the convolution layer in step (5) has a convolution kernel size of 1x1 and a step size of 1, and the convolution layer is used to perform channel transformation to further exchange global information;

[0094] The interpolation function is used to restore the scaled feature map to its original size, and the interpolation algorithm used is a bilinear interpolation algorithm;

[0095] The mean square error objective function is one of the commonly used objective functions in the field of artificial intelligence. It is used to match different features. The loss formulas for each part are as follows:

[0096]

[0097]

[0098] Distill loss =Feats loss +Logits loss

[0099] Where C, H, W represent the number of channels and the scale of the horizontal and vertical directions of the feature map, L represents the total number of reusable paradigm feature layers, N represents the number of training data, Feats dec [i][l](c,x,y) is the feature pixel at the (x,y)th position in the l-th layer feature map corresponding to the i-th sample obtained by decoding, Feats tea [i][l](c,x,y) is the feature pixel at the (x,y)th position in the l-th layer feature map of the i-th sample output by the teacher model, Logits dec [i] is the probability distribution corresponding to the i-th sample obtained by decoding, Logits tea [i] is the probability distribution of the i-th sample output by the teacher model; λ lIt is an optional parameter, which is calculated as the inverse of the ratio of the product of the size and channel of each feature map to its total;

[0100] For Logits stu The calculation of the original objective function refers to the objective function that the user applies to the field he needs, that is, Custom loss , the loss in this embodiment is the cross entropy loss, and its formula is as follows:

[0101]

[0102] Where M represents the number of categories, y ic Is a sign function (0 or 1), if the true category of sample i is equal to c then y ic Take 1, otherwise y ic Take 0, p ic The predicted probability that observation i belongs to category c.

[0103] Furthermore, the weighted parameters in step (6) include the weight parameters λ of each level defined and used in step (5). l The loss α controls the ratio of the distilled part to the original target loss. In this embodiment, the weight α is set to 0.5, so the formula is as follows:

[0104] Total loss =0.5×Distill loss +Custom loss

[0105] The backpropagation training student model refers to a method of optimizing the model using an error backpropagation optimization algorithm. The optimization algorithm used in this embodiment is the mini batch stochastic gradient descent algorithm SGD, and its formula is as follows:

[0106] Gradient estimation calculation formula, where m' is the number of mini batches, L is the loss function, and θ is the model parameter. To obtain the gradient for the model parameters, x and y are the samples and their corresponding labels respectively:

[0107]

[0108] Gradient update formula, where ∈ is the learning rate:

[0109] θ=θ-∈g

[0110] By student model M stu In imitating the teacher model M tea In the process, the global information interaction and fusion of the feature map information and the probability distribution before output are carried out to avoid the one-to-one matching learning teacher model M. teaThe local information in the , thus avoiding learning the backdoor trigger feature pattern based on local information, and thus removing the potential backdoor to obtain a secure student model M stu .

[0111] The backdoor attack defense system for AI model migration security includes the following modules:

[0112] The feature map processing module is used to align and convert the feature maps output by the ResNet20 student model before inputting them into the Transformer model, and to restore the feature blocks after the Transformer output to obtain the original-size feature maps.

[0113] The global information fusion module is used to calculate the global semantic information fusion weights of the ResNet20 student model feature blocks from each layer to remove the backdoor attack trigger mode based on local information;

[0114] The model training module is used to perform the training process of the ResNet20 student model, including performing inference, calculating model gradients, and processing the returned gradients according to the specified optimization algorithm.

[0115] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A backdoor attack countermeasure method for AI model migration security, comprising the following steps: 1) Select and initialize a model corresponding to the upper-level application task of the target application task as the teacher model M tea , obtain the teacher model M tea The pre-trained model weights are applied to the teacher model M tea The parameter weights are covered; select and initialize a model as the student model M stu ; 2) Input a sample of the image classification dataset into the teacher model and the student model respectively, and obtain the feature map set Feats consisting of the feature maps output by each intermediate layer of the teacher model tea And the probability distribution Logits of the last layer output of the teacher model tea , get the feature map set Feats composed of the feature maps output by each intermediate level of the student model stu And get the probability distribution Logits of the last layer output of the student model stu ; 3) Feats stu Each feature map in is processed into a feature block of set size, and the probability distribution Logits stu Processing makes its channel consistent with the channel of the feature block, and then the processed probability distribution Logits stu Combined with each of the feature blocks, they are input into the TransformerEncoder model, which uses the self-attention mechanism to interactively fuse the input information at different levels and outputs a feature map set Feats after the global level information is fused. merge and the probability distribution Logits after fusion of feature map information merge ; 4) Feats merge with Logits merge The decoded feature maps are then restored to the Feats model one by one. stu The size and number of channels of the feature map in the decoded probability distribution are restored to Logits stu The number of channels is used to obtain the global semantically weighted feature map set Feats dec Weighted fusion probability distribution Logits with feature maps dec ; 5) For the student model M stu Each intermediate level l, using the feature map set Feats dec The feature map corresponding to the inner middle layer l and Feats tea The loss calculation is performed on the feature map corresponding to the inner middle layer l, and the probability distribution Logits dec and the probability distribution Logits tea Perform loss calculation to obtain the probability distribution loss value Logits loss , according to the loss value Feats corresponding to each intermediate level loss and the probability distribution loss value Logits loss The sum is calculated to get the distillation loss value Distill loss ; According to the Logits corresponding to each sample stu Calculate the loss value Custom with the true label of the sample loss ; 6) According to the distillation loss value Distill loss and loss value Custom loss The calculated total loss is Total loss Optimize the student model M stu ; 7) Iterate and repeat steps 2)-6) until the student model M stu Convergence results in a security model that removes potential backdoors.

2. The method according to claim 1, characterized in that Select and initialize the number of output layers and the teacher model M tea consistent model or with the teacher model M tea The scale-consistent model is the student model M stu .

3. The method according to claim 2, characterized in that The student model M stu The model capability is equal to or weaker than the teacher model M tea .

4. The method according to claim 1, 2 or 3, characterized in that: The image classification dataset is a credible dataset, which is weaker in scale and annotation accuracy than the dataset used by the pre-training model.

5. The method according to claim 1, 2 or 3, characterized in that: Distill loss =Feats loss +Logits loss , Among them, C, H, and W represent the number of channels and the scale of the horizontal and vertical directions of the feature map, L is the number of layers in the middle layer, N is the number of training samples, and λ l is the proportion of the feature loss of the first layer in the total loss, C i Indicates the number of channels of the feature map corresponding to the i-th sample, H i Indicates the horizontal scale of the feature map corresponding to the i-th sample, W i Indicates the vertical scale of the feature map corresponding to the i-th sample, Feats dec [i][l](c,x,y) is the feature map of the lth layer corresponding to the i-th sample obtained by decoding, Feats tea [i][l](c,x,y) is the l-th layer feature map of the i-th sample output by the teacher model, Logits dec [i] is the probability distribution corresponding to the i-th sample obtained by decoding, Logits tea [i] is the probability distribution of the i-th sample output by the teacher model.

6. The method according to claim 5, characterized in that λ l It is the reciprocal of the ratio of the product of the size and channel of the feature map of the lth intermediate level to the sum of the product of the size and channel of each feature map.

7. The method according to claim 1, characterized in that Total loss =α×Distill loss +Custom loss ; α is a proportional coefficient, and the loss value Custom is calculated using the image classification field loss function loss .

8. A backdoor attack countermeasure system for AI model migration security, characterized by: Including teacher model M tea , Student Model M stu And training module; wherein, a model corresponding to the upper application task of the target application task is selected and initialized as the teacher model M tea , obtain the teacher model M tea The pre-trained model weights are applied to the teacher model M tea The parameter weights are covered; select and initialize a model as the student model M stu ; The teacher model M tea , which is used to process the samples in the input image classification field dataset to obtain the feature map set Feats composed of the feature maps output by each intermediate layer of the teacher model tea And the probability distribution Logits of the last layer output of the teacher model tea ; The student model M stu , which is used to process the samples in the input image classification field dataset to obtain the feature map set Feats composed of the feature maps output by each intermediate layer of the student model stu And get the probability distribution Logits of the last layer output of the student model stu ; The training module is used to stu Each feature map in is processed into a feature block of set size, and the probability distribution Logits stu Processing makes its channel consistent with the channel of the feature block, and then the processed probability distribution Logits stu Combined with each of the feature blocks, they are input into the TransformerEncoder model, which uses the self-attention mechanism to interactively fuse the input information at different levels and outputs a feature map set Feats after the global level information is fused. merge and the probability distribution Logits after fusion of feature map information merge ; Then Feats merge with Logits merge The decoded feature maps are then restored to the Feats model one by one. stu The size and number of channels of the feature map in the decoded probability distribution are restored to Logits stu The number of channels is used to obtain the global semantically weighted feature map set Feats dec Weighted fusion probability distribution Logits with feature maps dec ; Then for the student model M stu Each intermediate level l, using the feature map set Feats dec The feature map corresponding to the inner middle layer l and Feats tea The loss calculation is performed on the feature map corresponding to the inner middle layer l, and the probability distribution Logits dec With Teacher Model M tea Output probability distribution Logits tea Perform loss calculation to obtain the probability distribution loss value Logits loss , according to the loss value Feats corresponding to each intermediate level loss and the probability distribution loss value Logits loss The sum is calculated to get the distillation loss value Distill loss ; According to the Logits corresponding to each sample stu Calculate the loss value Custom with the true label of the sample loss ; Then according to the distillation loss value Distill loss and loss value Custom loss The calculated total loss is Total loss Optimize the student model M stu , until the student model M stu Convergence results in a security model that removes potential backdoors.

9. A server, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images