Data augmentation system and method for sar image dnn classification model backdoor defense

Abstract

The application discloses a data enhancement system and method for SAR image DNN classification model backdoor defense, and utilizes various backdoor attack technologies to generate a SAR image backdoor data set, carries out variable-length coding on a data enhancement combination strategy, adopts an offline automatic optimization technology, obtains an optimal data enhancement combination backdoor defense strategy which takes into account high defense performance and low model performance loss, inputs the optimal data enhancement combination backdoor defense strategy into an online backdoor defense performance evaluation module, and evaluates the test precision and attack success rate of the backdoor defense model after the optimal data enhancement combination strategy. The application first realizes SAR image DNN classification model robust backdoor defense based on data enhancement automatic combination optimization, effectively resists various backdoor attacks by disturbing the trigger pattern in the backdoor model and eliminating the feature memory of the backdoor model to the trigger, while only losing a lower model performance, and thus improves the security of the model.

Description

Technical Field

[0001] This invention relates to backdoor defense technology for SAR (Synthetic Aperture Radar) image classification models in the field of intelligent remote sensing, and particularly to a data augmentation system and method for backdoor defense of SAR image DNN (Deep Neural Network) classification models. Background Technology

[0002] Backdoor attacks are malicious attacks on deep neural networks (DNNs) with extremely serious consequences. Attackers generate backdoor models by implanting triggers into the training data. These models behave normally when given benign input data, but when given data containing the triggers, the backdoor model performs the actions specified by the attacker. This type of attack is highly stealthy and difficult to detect. For example, an attacker can implant a backdoor trigger to misidentify a normal face recognition model as someone else, or to misinterpret a normal speech recognition model as speaking a different language. Such attacks not only affect individual users but also have a significant impact on businesses, governments, and other organizations.

[0003] Synthetic Aperture Radar (SAR) is an active microwave imaging sensor with advantages such as being unaffected by factors like clouds, fog, and lighting conditions, and being able to observe target areas at any time, leading to its widespread application in both civilian and military fields. Due to the importance of its applications, the security of SAR image DNN classification models has attracted considerable attention, making the design of backdoor attack defense schemes for SAR image DNN classification models particularly necessary.

[0004] Existing backdoor defense strategies mainly include backdoor scanning, backdoor detection, and backdoor removal. Backdoor scanning and detection primarily detect the presence of backdoors but cannot remove them, thus failing to achieve the intended defense. Backdoor removal relies on normal samples to suppress injected backdoors, but suffers from poor defensive performance and excessive computational costs. For SAR image DNN classification models, designing an effective backdoor removal defense scheme with minimal loss of the original model performance is a pressing technical challenge.

[0005] Data augmentation is a fundamental concept that improves a model's generalization ability and robustness by performing a series of transformations on the original data to generate more data samples. In the traditional image domain, common data augmentation methods include mirroring, random cropping, and color transformation. Applying data augmentation to backdoor attack defense allows the model to read more image features, improving its generalization ability while reducing the success rate of backdoor attacks by perturbing backdoor attack triggers in the image. Existing data augmentation-based backdoor defense techniques are mainly limited to the traditional image domain, with few research reports in the SAR image domain. Furthermore, existing backdoor defense techniques require extensive expert experience to design targeted data augmentation methods for different backdoor attacks and different image datasets, achieving better results. Therefore, how to automatically design a suitable data augmentation combination strategy to effectively defend against various backdoor attacks targeting SAR image DNN classification models while reducing reliance on expert experience is a topic worthy of in-depth research by both academia and engineering. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by providing a data augmentation system and method for backdoor defense in SAR image DNN classification models.

[0007] The objective of this invention is achieved through the following technical solution: The first aspect of this invention provides a data augmentation system for backdoor defense of SAR image DNN classification models, the system comprising a SAR image data acquisition module, an offline automatic optimization module for data augmentation combination strategies for backdoor defense of SAR image DNN classification models, and an online performance evaluation module for backdoor defense of SAR image DNN classification models;

[0008] The SAR image data acquisition module is used to obtain the center of the target to be detected based on images from the SAR historical database. Taking the center of the smallest circumscribed circle of the target center as the midpoint, it expands outward by 128 pixels to obtain a SAR image slice dataset of size 256 pixels × 256 pixels. The image slice dataset is normalized and labeled with categories, and divided into a clean dataset, a dataset to be poisoned, and a dataset to be augmented. The clean dataset is divided into a clean training set and a clean test set. Backdoor attack technology is used to poison the dataset to be poisoned to obtain different backdoor datasets, which are then divided into a backdoor training set and a backdoor test set. The clean training set, clean test set, backdoor training set, backdoor test set, and dataset to be augmented are respectively input into the offline automatic optimization module of the data augmentation combination strategy for backdoor defense of the SAR image DNN classification model and the online backdoor defense performance evaluation module of the SAR image DNN classification model.

[0009] The offline automatic optimization module for the data augmentation combination strategy of the SAR image DNN classification model backdoor defense is used to obtain the optimal data augmentation combination backdoor defense strategy that balances high defense and low performance loss based on the offline automatic optimization technology of the data augmentation combination strategy, and transmit it to the online backdoor defense performance evaluation module of the SAR image DNN classification model.

[0010] The SAR image DNN classification model online backdoor defense performance evaluation module is used to train the DNN classification model on different backdoor training sets to obtain multiple backdoor models, apply the optimal data augmentation combination defense strategy to different backdoor models for defense, and evaluate the test accuracy and attack success rate of the defended backdoor models on different backdoor test sets.

[0011] A second aspect of this invention provides a data augmentation method for backdoor defense of SAR image DNN classification models using the above-described system, comprising the following steps:

[0012] (1) The SAR image data acquisition module is used to acquire the center of the target to be detected, slice the image and label the category to obtain the source dataset X. The size of each image is scaled to 256 pixels × 256 pixels and the data is normalized according to formula (1) to obtain the preprocessed dataset X. o , will X o The dataset X is split in a 1:2 ratio to obtain a clean dataset. c and the dataset X to be augmented a , clean dataset X c 10% as the dataset to be poisoned X p The remaining 90% is divided into a clean training set Xc-train and a clean test set Xc-valid in a 4:1 ratio. c-valid X p and X a The offline automatic optimization module for data augmentation combination strategies input into the SAR image DNN classification model backdoor defense is used.

[0013]

[0014] Among them, X oj Represents the preprocessed dataset X o The feature of the j-th dimension, X j Let d represent the j-th dimension of the source dataset X, and let d represent the feature of X. o The maximum value of the dimension;

[0015] (2) Set the parameter values ​​for the offline automatic optimization module of the data augmentation combination strategy for backdoor defense of the SAR image DNN classification model. The parameter values ​​include the minimum length value l of the data augmentation combination strategy. min The maximum length value of data augmentation combination strategies l max The deep neural network (DNN) classification model AlexNet, the training epoch 1 of the DNN classification model with a backdoor embedded, the training epoch 2 of the DNN classification model for fine-tuning, the learning rate Lr1 of the DNN classification model, the population size N, the maximum number of iterations G, the crossover rate σ, and the mutation rate θ; the deep neural network (DNN) classification model AlexNet is labeled as Model;

[0016] (3) Initialize N individuals as the initial population Q = {x i ,i=1,2,…,N},x i This represents the i-th individual; each individual represents a data augmentation combined defense strategy, encoded as follows: Among them l i Let l represent the length of the data augmentation combination strategy corresponding to the i-th individual. i The initialization process starts from l min and l max A randomly generated integer, Aug, within the range of [range]. i1 Aug i2 , These represent the 1st, 2nd, and 1st data augmentation methods randomly selected by the i-th individual from the data augmentation set. The data augmentation set is denoted as Augmentation, and Augmentation consists of [Translation, ShiftScaleRotate, OD, GAMMA, DOWN, Sharpen, Defocus, PixelDropout, RandomBrightnessContrast, UnsharpMask, WienerFilter, MedianBlur, AdvancedBlur, Blur, GaussianBlur, GlassBlur, MotionBlur, ZoomBlur, WeibullNoise, RayleighNoise, JiedaunNoise, PepperNoise, MultiplicativeNoise, GN, PROTAT, RAND, FD, BdR, PD, SHIELD]. In encoding, these are represented by... [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20,21,22,23,24,25,26,27,28,29] represents the random cropping of the SAR image; ShiftScaleRotate represents the random application of translation, scaling, and rotation to the SAR image; OD represents mapping the representation information of the SAR image to a dimension far removed from the original image in a hyperdimensional space; GAMMA represents the processing of the SAR image... Gamma compression preprocessing; DOWN indicates shrinking and then enlarging the SAR image; Sharpen indicates sharpening the SAR image; Defocus indicates defocusing the SAR image; PixelDropout indicates setting the pixel values ​​at certain locations in the SAR image to 0 with a 50% probability; RandomBrightnessContrast indicates randomly adjusting the brightness and contrast of the SAR image; UnsharpMask indicates first applying Gaussian blur to the SAR image, then subtracting 0 from the original image.Image blurred 5 times by Gaussian; WienerFilter indicates Wiener filtering of the SAR image; MedianBlur indicates median filtering of the SAR image; AdvancedBlur indicates generalized normal filtering of the SAR image; Blur indicates blurring of the SAR image using a kernel of random size; GaussianBlur indicates Gaussian filtering of the SAR image; GlassBlur indicates glass filtering of the SAR image; MotionBlur indicates motion blur of the SAR image using a kernel of random size; ZoomBlur indicates zoom blur of the SAR image; WeibullNoise indicates adding Weibull distribution noise to the SAR image; RayleighNoise indicates adding Rayleigh distribution noise to the SAR image; JiedaunNoise indicates adding truncated exponential distribution noise to the SAR image. Noise; PepperNoise adds salt-and-pepper distributed noise to a SAR image; MultiplicativeNoise multiplies a SAR image by an array of the same size as the SAR image, randomly sampled from [0.9, 1.1); GN adds Gaussian distributed noise to a SAR image; PROTAT combines translation, scaling, and rotation into a single process by adding randomness and applies it to a SAR image; RAND randomly fills in random regions of a SAR image; FD performs standard continuous-tone still image digital compression and encoding on a SAR image; BdR reduces the bit depth and spatial smoothness of each pixel in a SAR image; PD adds insensitive random noise to a SAR image; SHIELD performs randomized quantization on a SAR image by assigning different quantization factors to each window during JPEG compression.

[0017] (4) Performance evaluation of the initial population Q: Randomly select one attack technique from five backdoor attack techniques and apply it to the dataset X to be poisoned. p Above, a backdoor dataset X is formed. b , will X b The training set X is divided into two parts according to a 4:5 ratio. b-train and backdoor test set X b-test In X c-train and X b-train The model is trained 1 epoch on the collection, with a learning rate of Lr1, forming the backdoor model M. back Based on the data augmentation information of each individual representation in Q, the backdoor test set X is respectively... b-test and the dataset X to be augmented aData augmentation was performed to create augmented backdoor test sets X. b-test-agu and fine-tuning dataset X fine-tune1 In X fine-tune1 Above M back The model is trained for 2 epochs, with a learning rate of Lr1, resulting in a fine-tuned model M. fine-tune The fine-tuning model M is calculated according to formulas (2) and (3) respectively. fine-tune On the clean test set X c-test and Enhanced Backdoor Test Set X b-test-agu The attack success rate and test accuracy error are calculated, and the comprehensive target value F corresponding to each individual is calculated according to formula (4); wherein the five backdoor attack techniques include a backdoor neural network labeled BadNet, a hybrid attachment injection strategy labeled Blended, a backdoor signal labeled Sig, a twisted backdoor labeled WaNet, and a reflection backdoor labeled Refool;

[0018]

[0019] Where f1 represents the attack success rate, and N clean-err For X c-test The number of incorrectly predicted samples, N clean-all For X c-test The total number of samples;

[0020]

[0021] Where f2 represents the test accuracy error, N back-err For X b-test-agu The number of backdoor samples that were predicted incorrectly, N back-all For X b-test-agu The total number of samples;

[0022] F = f1 + f2 (4)

[0023] Where F represents the comprehensive target value corresponding to each individual;

[0024] (5) Perform crossover on population Q according to the binary bidding competition method: randomly select two individuals from population Q as parent individuals, randomly generate a floating-point number q1 between 0 and 1, and determine the relationship between q1 and the crossover rate σ. If q1 > σ, the parent individuals do not need to be crossovered; otherwise, mark the two parent individuals as... and Among them l 1 x represents p1 The corresponding data augmentation combination strategy length, They represent the xth... p1The first, second, and lth data augmentation methods are randomly selected from the data augmentation set Augmentation by each individual. 2 x represents p2 The corresponding data augmentation combination strategy length, They represent the xth... p2 Each individual randomly selects the 1st, 2nd, and 1st data augmentation methods from the data augmentation set Augmentation, and randomly generates a value from 1 to (l). 1 An integer C1 between x and 1) is used as x. p1 The crossover point is randomly generated from 1 to (l 2 The integer C2 between +1) is used as x. p2 The crossover point, for x p1 and x p2 Perform a single-point crossover to generate two offspring individuals y. c1 and y c2 The generated y c1 and y c2 Store the data into a new population P, and repeat the above operation until the size of population P equals N. Mark the final population P as P = {y}. j ,j=1,2,…,N};

[0025] (6) Perform mutation operation on population P: Randomly select an individual from population P. Randomly generate a set of floating-point numbers between 0 and 1 {r jk k = 1, 2, ..., l j}, respectively determine r jk The relationship between r and the rate of variation θ, if r jk >θ, then Aug jk The corresponding encoding is not mutated; otherwise, a different data augmentation encoding is randomly selected from the encodings corresponding to the data augmentation set Augmentation to replace Aug. jk The original encoded information; the population after the mutation operation is labeled as P. M ;

[0026] (7) Population P M The population is merged with population Q to obtain population R. Following the performance evaluation method in step (4), population R is evaluated for the target value F, and then sorted in ascending order based on F. The top N individuals of the sorted population R are selected to form a new offspring population Q. n ;

[0027] (8) Unconditionally accept Q = Q n ;

[0028] (9) Repeat steps (3) to (8) until the set number of iterations G is met;

[0029] (10) The final Q obtained n The individual with the smallest F in the population is selected as the optimal individual x. best That is, to obtain the optimal data augmentation combination backdoor defense strategy for SAR image DNN classification models;

[0030] (11) Input the parameter values ​​of the SAR image DNN classification model online backdoor defense performance evaluation module, including the deep neural network DNN classification model AlexNet, the training round Epoch3 after the DNN classification model is embedded in the backdoor, the learning rate Lr2 of the DNN classification model training in the online backdoor defense performance evaluation stage, and the training round Epoch4 of the DNN classification model fine-tuning.

[0031] (12) BadNet, Blended, Sig, WaNet and Refool backdoor attack techniques were used to treat the poisoned dataset X. p Perform a backdoor attack to obtain the corresponding backdoor dataset X. b-BadNet X b-Blended X b-Sig X b-WaNet and X b-Refool The dataset was divided into two parts, BadNet backdoor training set X and X, in a 4:1 ratio. b-train-BadNet and BadNet backdoor test set X b-test-BadNet Blended backdoor training set X b-train-Blended and Blended backdoor test set X b-test-Blended Sig backdoor training set X b-train-Sig and Sig backdoor test set X b-test-Sig WaNet backdoor training set X b-train-WaNet and WaNet backdoor test set X b-test-WaNet and the Refool backdoor training set X b-train-Refool and Refool backdoor test set X b-test-Refool The optimal data augmentation combination obtained in step (10) will be used to develop a backdoor defense strategy x. best Applied to the dataset X to be augmented respectively a and five backdoor test datasets X b-test-BadNet X b-test-Blended X b-test-Sig X b-test-WaNet and X b-test-Refool Generate fine-tuning dataset X fine-tune2 and five enhanced backdoor test datasets X b-test-agu-BadNet X b-test-agu-Blended X b-test-agu-Sig Xb-test-agu-WaNet and X b-test-agu-Refool ;

[0032] (13) Train the model Model for 3 epochs on the dataset that combines the five backdoor training datasets and the clean training dataset, with a learning rate of Lr2, to obtain the corresponding backdoor model M. back-BadNet M back-Blended M back-Sig M back-WaNet and M back-Refool In fine-tuning dataset X fine-tune2 The above steps involve training five backdoor models for four epochs, with a learning rate of Lr², to obtain the corresponding fine-tuned model M. fine-tune-BadNet M fine-tune-Blended M fine-tune-Sig M fine-tune-WaNet and M fine-tune-Refool ;

[0033] (14) Using M back-BadNet M back-Blended M back-Sig M back-WaNet and M back-Refool For the clean test set X respectively c-test and the corresponding backdoor test set X b-test-BadNet X b-test-Blended X b-test-Sig X b-test-WaNet and X b-train-Refool SAR image classification was performed, and the test accuracy and attack success rate of the five backdoor models were calculated according to formulas (5) and (6), respectively; using M fine-tune-BadNet M fine-tune-Blended M fine-tune-Sig M fine-tune-WaNet and M fine-tune-Refool For the clean test set X c-test and the corresponding enhanced backdoor test set X b-test-agu-BadNet X b-test-agu-Blended X b-test-agu-Sig X b-test-agu-WaNet and X b-test-agu-Refool Perform SAR image classification, and calculate the test accuracy and attack success rate of the five fine-tuning models according to formulas (7) and (8);

[0034]

[0035]

[0036]

[0037]

[0038] Where BA represents the test accuracy of the backdoor model, and N true N represents the number of samples that are correctly predicted in the clean test set. all N represents the total number of clean test set samples, ASR represents the attack success rate of the backdoor model, and N represents the total number of clean test set samples. back-true N represents the number of samples that were correctly predicted on the backdoor test set. back-all N represents the total number of backdoor test set samples, FA represents the test accuracy of the fine-tuned model, FASR represents the attack success rate of the fine-tuned model, and N represents the attack success rate of the fine-tuned model. back-true-agu This indicates that the number of correctly predicted backdoors on the test set will be increased, N. back-all This represents the total number of samples in the enhanced backdoor test set.

[0039] The beneficial effects of this invention are that it is the first to achieve robust backdoor defense for SAR image DNN classification models based on data augmentation and automatic combination optimization. While only sacrificing the classification performance of the DNN classification model, it effectively resists various backdoor attacks by disrupting the trigger patterns in the backdoor model and eliminating the backdoor model's feature memory of the triggers, thereby improving the security and robustness of the SAR image DNN classification model. Attached Figure Description

[0040] Figure 1 This is a schematic diagram illustrating the principle of a data augmentation system and method for backdoor defense in SAR image DNN classification models;

[0041] Figure 2 This is an example graph of individuals with a randomly generated data augmentation combination strategy of length 5;

[0042] Figure 3 This is an example diagram of crossover operations performed on two parent individuals with lengths of 5 and 7, respectively, in a data augmentation combination strategy.

[0043] Figure 4 This is an example diagram of a data augmentation combination strategy of length 5 performing mutation operations on an individual at a certain mutation site.

[0044] Figure 5This is a comparison chart showing the changes in DNN classification model accuracy before and after the method of this invention is applied to defend against five existing backdoor attacks, including Backdoored Neural Network (BadNet), Blended Accessory Injection Strategy (Blended), Backdoor Signals (Sig), Warping-based Backdoor (WaNet), and Reflection Backdoor (Refool).

[0045] Figure 6 This is a comparison chart showing the change in attack success rate before and after backdoor defense using the method of this invention and existing technologies BadNet, Blended, Sig, WaNet and Refool on SAR image DNN classification models. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Taking the AlexNet classification model of Gaofen-3 SAR images as an example, Figure 1 A schematic diagram of the data augmentation system and method for backdoor defense in SAR image DNN classification models is presented.

[0048] See Figure 1 The data augmentation system for backdoor defense of SAR (Synthetic Aperture Radar) image DNN (Deep Neural Network) classification models of the present invention includes a SAR image data acquisition module, an offline automatic optimization module for data augmentation combination strategies for backdoor defense of SAR image DNN classification models, and an online performance evaluation module for backdoor defense of SAR image DNN classification models.

[0049] In this embodiment, the SAR image data acquisition module is used to obtain the center of the target to be detected based on images from the SAR historical database. Using the center of the smallest circumscribed centrifugal circle of the target center as the midpoint, it expands outward by 128 pixels to obtain a SAR image slice dataset of size 256 pixels × 256 pixels. The image slice dataset is normalized and labeled, and divided into a clean dataset, a dataset to be poisoned, and a dataset to be augmented. The clean dataset is further divided into a clean training set and a clean test set. Existing backdoor attack techniques are used to poison the dataset to obtain different backdoor datasets, which are then divided into backdoor training sets and backdoor test sets. The clean training set, clean test set, backdoor training set, backdoor test set, and dataset to be augmented are input into the offline automatic optimization module for the data augmentation combination strategy of the SAR image DNN classification model backdoor defense and the online backdoor defense performance evaluation module of the SAR image DNN classification model, respectively.

[0050] In this embodiment, the offline automatic optimization module for the data augmentation combination strategy of the SAR image DNN classification model backdoor defense is used to obtain the optimal data augmentation combination backdoor defense strategy that balances high defense and low performance loss based on the offline automatic optimization technology of the data augmentation combination strategy, and then transmits it to the online backdoor defense performance evaluation module of the SAR image DNN classification model.

[0051] In this embodiment, the SAR image DNN classification model online backdoor defense performance evaluation module is used to train the DNN classification model on different backdoor training sets to obtain multiple backdoor models. The optimal data augmentation combination defense strategy is applied to the different backdoor models for defense, and the test accuracy and attack success rate of the backdoor model after defense are evaluated on different backdoor test sets.

[0052] It is worth mentioning that the present invention also provides a data augmentation method for backdoor defense of SAR image DNN classification models, which is based on the data augmentation system for backdoor defense of SAR image DNN classification models described in the above embodiments.

[0053] See Figure 1 The data augmentation method for backdoor defense of SAR image DNN classification models of the present invention specifically includes the following steps:

[0054] (1) The SAR image data acquisition module is used to acquire the center of the target to be detected, slice the image and label the category to obtain the source dataset X. The size of each image is scaled to 256 pixels × 256 pixels and the data is normalized according to formula (1) to obtain the preprocessed dataset X. o , will X o The dataset X is split in a 1:2 ratio to obtain a clean dataset.c and the dataset X to be augmented a , clean dataset X c 10% as the dataset to be poisoned X p The remaining 90% is divided into a clean training set Xc-train and a clean test set Xc-valid in a 4:1 ratio. c-valid X p and X a The offline automatic optimization module is used to combine data augmentation strategies for backdoor defense in SAR image DNN classification models.

[0055]

[0056] Among them, X oj Represents the preprocessed dataset X o The feature of the j-th dimension, X j Let d represent the j-th dimension of the source dataset X, and let d represent the feature of X. o The maximum value of the dimension.

[0057] (2) Set the parameter values ​​for the offline automatic optimization module of the data augmentation combination strategy for backdoor defense of the SAR image DNN classification model. The parameter values ​​include the minimum length value l of the data augmentation combination strategy. min =3. Maximum length value of data augmentation combination strategy l max =8. Deep Neural Network (DNN) classification model AlexNet (a deep convolutional neural network named after its designer Alex Krizhevsky, labeled as Model), training epochs of the DNN classification model with backdoor embedded: Epoch1 = 30, training epochs of the DNN classification model for fine-tuning: Epoch2 = 5, learning rate of the DNN classification model: Lr1 = 0.001, population size: N = 40, maximum number of iterations: G = 20, crossover rate: σ = 0.8, mutation rate: θ = 0.1.

[0058] (3) Initialize N individuals as the initial population Q = {x i ,i=1,2,…,N},x i Let represent the i-th individual. Each individual represents a data augmentation combined defense strategy, encoded as follows: Among them l i Let l represent the length of the data augmentation combination strategy corresponding to the i-th individual. i The initialization process starts from l min and l max A randomly generated integer, Aug, within the range of [range]. i1 Aug i2 , These represent the 1st, 2nd, and 1st data augmentation methods randomly selected by the i-th individual from the data augmentation set. The data augmentation set is denoted as Augmentation, and Augmentation consists of [Translation, ShiftScaleRotate, OD, GAMMA, DOWN, Sharpen, Defocus, PixelDropout, RandomBrightnessContrast, UnsharpMask, WienerFilter, MedianBlur, AdvancedBlur, Blur, GaussianBlur, GlassBlur, MotionBlur, ZoomBlur, WeibullNoise, RayleighNoise, JiedaunNoise, PepperNoise, MultiplicativeNoise, GN, PROTAT, RAND, FD, BdR, PD, SHIELD]. In encoding, these are represented by... [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,29,20,21,22,23,24,25,26,27,28,29] represents the random cropping of the SAR image; ShiftScaleRotate represents the random application of translation, scaling, and rotation to the SAR image; OD represents mapping the representation information of the SAR image to a dimension far removed from the original image in a hyperdimensional space; GAMMA represents the processing of the SAR image... Gamma compression preprocessing; DOWN indicates shrinking and then enlarging the SAR image; Sharpen indicates sharpening the SAR image; Defocus indicates defocusing the SAR image; PixelDropout indicates setting the pixel values ​​at certain locations in the SAR image to 0 with a 50% probability; RandomBrightnessContrast indicates randomly adjusting the brightness and contrast of the SAR image; UnsharpMask indicates first applying Gaussian blur to the SAR image, then subtracting 0 from the original image.Image after 5x Gaussian blur; WienerFilter indicates Wiener filtering of the SAR image; MedianBlur indicates median filtering of the SAR image; AdvancedBlur indicates generalized normal filtering of the SAR image; Blur indicates blurring of the SAR image using a kernel of random size; GaussianBlur indicates Gaussian filtering of the SAR image; GlassBlur indicates glass filtering of the SAR image; MotionBlur indicates motion blur of the SAR image using a kernel of random size; ZoomBlur indicates zoom blur of the SAR image; WeibullNoise indicates adding Weibull distribution noise to the SAR image; RayleighNoise indicates adding Rayleigh distribution noise to the SAR image; JiedaunNoise indicates adding truncated exponential distribution noise to the SAR image. The noise levels are as follows: PepperNoise adds salt-and-pepper noise to the SAR image; MultiplicativeNoise multiplies the SAR image by an array of the same size as the SAR image, randomly sampled from [0.9, 1.1); GN adds Gaussian noise to the SAR image; PROTAT combines translation, scaling, and rotation into a single process by adding randomness and applies it to the SAR image; RAND randomly fills in random regions of the SAR image; FD performs standard continuous-tone still image digital compression and encoding on the SAR image; BdR reduces the bit depth and spatial smoothness of each pixel in the SAR image; PD adds insensitive random noise to the SAR image; and SHIELD performs randomized quantization on the SAR image by assigning different quantization factors to each window during JPEG compression.

[0059] In this embodiment, a randomly generated individual with a data augmentation combination strategy of 5 is as follows: Figure 2 As shown, where, Figure 2 (a) The encoding information of the individual is given, which is [5, 11, 2, 8, 5, 7]. The first encoding "5" in the individual indicates that the length of the data augmentation combination strategy is 5. The second encoding "11" corresponds to the data augmentation method MedianBlur. The third encoding "2" corresponds to the data augmentation method OD. The fourth encoding "8" corresponds to the data augmentation method RandomBrightnessContrast. The fifth encoding "5" corresponds to the data augmentation method Sharpen. The sixth encoding "7" corresponds to the data augmentation method PixelDropout. Figure 2(b) represents a SAR image processed by the data augmentation strategy corresponding to the individual's encoding, from... Figure 2 (b) It can be seen that the SAR image is augmented based on the encoded information.

[0060] (4) Performance evaluation of the initial population Q: Randomly select one attack technique from five backdoor attack techniques and apply it to the dataset X to be poisoned. p Above, a backdoor dataset X is formed. b , will X b The training set X is divided into two parts according to a 4:5 ratio. b-train and backdoor test set X b-test In X c-train and X b-train The model is trained on the collection of data for Epoch 1 = 30, with a learning rate of Lr1 = 0.001, forming the backdoor model M. back Based on the data augmentation information of each individual representation in Q, the backdoor test set X is respectively... b-test and the dataset X to be augmented a Data augmentation was performed to create augmented backdoor test sets X. b-test-agu and fine-tuning dataset X fine-tune1 In X fine-tune1 Above M back Epoch 2 = 5 training iterations were performed, with a learning rate of Lr1 = 0.001, resulting in a fine-tuned model M. fine-tune The fine-tuning model M is calculated according to formulas (2) and (3) respectively. fine-tune On the clean test set X c-test and Enhanced Backdoor Test Set X b-test-agu The attack success rate and test accuracy error are calculated, and the comprehensive target value F corresponding to each individual is calculated according to formula (4).

[0061] In this embodiment, the five backdoor attack techniques are: Backdoored Neural Network (labeled BadNet), Blended Accessory Injection Strategy (labeled Blended), Backdoor Signals (labeled Sig), Warping-based Backdoor (labeled WaNet), and Reflection Backdoor (labeled Refool).

[0062]

[0063] Where f1 represents the attack success rate, and Nclean-err For X c-test The number of incorrectly predicted samples, N clean-all For X c-test The total number of samples.

[0064]

[0065] Where f2 represents the test accuracy error, N back-err For X b-test-agu The number of backdoor samples that were predicted incorrectly, N back-all For X b-test-agu The total number of samples.

[0066] F = f1 + f2 (4)

[0067] Where F represents the comprehensive target value for each individual.

[0068] (5) Perform crossover on population Q according to the binary bidding competition method: randomly select two individuals from population Q as parent individuals, randomly generate a floating-point number q1 between 0 and 1, and determine the relationship between q1 and the crossover rate σ. If q1 > σ, the parent individuals do not need to be crossovered; otherwise, mark the two parent individuals as... and Among them l 1 x represents p1 The corresponding data augmentation combination strategy length, They represent the xth... p1 The first, second, and lth data augmentation methods are randomly selected from the data augmentation set Augmentation by each individual. 2 x represents p2 The corresponding data augmentation combination strategy length, They represent the xth... p2 Each individual randomly selects the 1st, 2nd, and 1st data augmentation methods from the data augmentation set Augmentation, and randomly generates a value from 1 to (l). 1 An integer C1 between x and 1) is used as x. p1 The crossover point is randomly generated from 1 to (l 2 The integer C2 between +1) is used as x. p2 The crossover point, for x p1 and x p2 Perform a single-point crossover to generate two offspring individuals y. c1 and y c2 The generated y c1 and y c2Store the data into a new population P, and repeat the above operation until the size of population P equals N. Mark the final population P as P = {y}. j ,j=1,2,…,N}, such as Figure 3 As shown.

[0069] For example, Figure 3 Example graphs are given showing crossover operations between two parent individuals with lengths of 5 and 7, respectively, where the two parent individuals are labeled x. p1 =[5,11,2,8,5,7] and x p2 = [7,14,6,4,3,22,9,10], with randomly generated crossover points C1=3 and C2=4. The two offspring individuals generated after the crossover operation are labeled as y. c1 =[6,11,2,3,22,9,10] and y c2 =[6,14,6,4,8,5,7].

[0070] (6) Perform mutation operation on population P: Randomly select an individual from population P. Randomly generate a set of floating-point numbers between 0 and 1 {r jk k = 1, 2, ..., l j}, respectively determine r jk The relationship between r and the rate of variation θ, if r jk >θ, then Aug jk The corresponding encoding is not mutated; otherwise, a different data augmentation encoding is randomly selected from the encodings corresponding to the data augmentation set Augmentation to replace Aug. jk The original encoded information; the population after the mutation operation is labeled as P. M .like Figure 4 As shown, an example diagram is given of an individual with a data augmentation combination strategy of length 5 undergoing mutation operation at a certain mutation site.

[0071] (7) Population P M The population is merged with population Q to obtain population R. Following the performance evaluation method in step (4), population R is evaluated for the target value F, and then sorted in ascending order based on F. The top N individuals of the sorted population R are selected to form a new offspring population Q. n .

[0072] (8) Unconditionally accept Q = Q n .

[0073] (9) Repeat steps (3) to (8) until the set number of iterations G = 20 is met.

[0074] (10) The final Q obtainedn The individual with the smallest F in the population is selected as the optimal individual x. best =[7,28,20,14,3,29,21,11], which means obtaining the optimal data augmentation combination backdoor defense strategy [7,28,20,14,3,29,21,11] for the SAR image DNN classification model.

[0075] (11) Input the parameter values ​​of the SAR image DNN classification model online backdoor defense performance evaluation module, including the deep neural network DNN classification model AlexNet (labeled as Model), the training round Epoch3=30 after the DNN classification model is embedded in the backdoor, the learning rate Lr2=0.001 of the DNN classification model training in the online backdoor defense performance evaluation stage, and the training round Epoch4=50 of the DNN classification model fine-tuning.

[0076] (12) BadNet, Blended, Sig, WaNet and Refool backdoor attack techniques were used to treat the poisoned dataset X. p Perform a backdoor attack to obtain the corresponding backdoor dataset X. b-BadNet X b-Blended X b-Sig X b-WaNet and X b-Refool The dataset was divided into two parts, BadNet backdoor training set X and X, in a 4:1 ratio. b-train-BadNet and BadNet backdoor test set X b-test-BadNet Blended backdoor training set X b-train-Blended and Blended backdoor test set X b-test-Blended Sig backdoor training set X b-train-Sig and Sig backdoor test set X b-test-Sig WaNet backdoor training set X b-train-WaNet and WaNet backdoor test set X b-test-WaNet and the Refool backdoor training set X b-train-Refool and Refool backdoor test set X b-test-Refool The optimal data augmentation combination obtained in step (10) will be used to develop a backdoor defense strategy x. best Applied to the dataset X to be augmented respectively a and five backdoor test datasets X b-test-BadNet X b-test-Blended X b-test-Sig X b-test-WaNet and X b-test-Refool Generate fine-tuning dataset X fine-tune2 and five enhanced backdoor test datasets X b-test-agu-BadNet X b-test-agu-Blended X b-test-agu-Sig X b-test-agu-WaNetand X b-test-agu -Refoo l .

[0077] (13) The model Model was trained for 30 epochs on the dataset that combined the five backdoor training datasets and the clean training dataset, with a learning rate of Lr2 = 0.001, to obtain the corresponding backdoor model M. back-BadNet M back-Blended M back-Sig M back-WaNet and M back-Refool In fine-tuning dataset X fine-tune2 Five backdoor models were trained for Epoch 4 = 50 times, with a learning rate of Lr2 = 0.001, to obtain the corresponding fine-tuned model M. fine-tune-BadNet M fine-tune-Blended M fine-tune-Sig M fine-tune-WaNet and M fine-tune-Refool .

[0078] (14) Using M back-BadNet M back-Blended M back-Sig M back-WaNet and M back-Refool For the clean test set X respectively c-test and the corresponding backdoor test set X b-test-BadNet X b-test-Blended X b-test-Sig X b-test-WaNet and X b-train-Refool SAR image classification was performed, and the test accuracy (labeled as BA) and attack success rate (labeled as ASR) of the five backdoor models were calculated according to formulas (5) and (6), respectively; using M fine-tune-BadNet M fine-tune-Blended M fine-tune-Sig M fine-tune-WaNet and M fine-tune-Refool For the clean test set X c-test and the corresponding enhanced backdoor test set X b-test-agu-BadNet X b-test-agu-Blended X b-test-agu-Sig X b-test-agu-WaNet and X b-test-agu-Refool Perform SAR image classification, and calculate the test accuracy (labeled as FA) and attack success rate (labeled as FASR) of the five fine-tuning models according to formulas (7) and (8).

[0079]

[0080]

[0081]

[0082]

[0083] Where BA represents the test accuracy of the backdoor model, and N true N represents the number of samples that are correctly predicted in the clean test set. all N represents the total number of clean test set samples, ASR represents the attack success rate of the backdoor model, and N represents the total number of clean test set samples. back-true N represents the number of samples that were correctly predicted on the backdoor test set. back-all N represents the total number of backdoor test set samples, FA represents the test accuracy of the fine-tuned model, FASR represents the attack success rate of the fine-tuned model, and N represents the attack success rate of the fine-tuned model. back-true-agu This indicates that the number of correctly predicted backdoors on the test set will be increased, N. back-all This represents the total number of samples in the enhanced backdoor test set.

[0084] It should be understood that the closer the BA and FA are, the smaller the FASR, indicating that the data augmentation combined defense strategy is more effective.

[0085] Comparative experiments were conducted on the above embodiments using the method of the present invention. Figure 5 The paper presents a comparison of the DNN classification model test accuracy changes before and after implementing the method of the present invention for backdoor defense against five existing backdoor attacks, including Backdoored Neural Network (BadNet), Blended Accessory Injection Strategy (Blended), Backdoor Signals (Sig), Warping-based Backdoor (WaNet), and Reflection Backdoor (Refool). Figure 6 A comparison chart is provided showing the change in attack success rate before and after applying the method of this invention to backdoor defense on SAR image DNN classification models, compared with existing technologies BadNet, Blended, Sig, WaNet, and Refool. From... Figure 5 and Figure 6 It is not difficult to see that when the method of this invention is used to defend against five existing backdoor attack techniques, BadNet, Blended, Sig, WaNet and Refool, the FA performance index is close to the BA performance index before defense, and the FASR performance index is much smaller than the ASR performance index. This means that the method of this invention greatly reduces the success rate of backdoor attacks while minimizing the loss of test accuracy in the backdoor model.

[0086] In summary, this invention is the first to achieve robust backdoor defense for SAR image DNN classification models based on data augmentation and automatic combination optimization. While only sacrificing the classification performance of the DNN model, it effectively resists various backdoor attacks by disrupting the trigger patterns in the backdoor model and eliminating the backdoor model's feature memory of the triggers, thereby improving the security and robustness of the SAR image DNN classification model.

[0087] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data enhancement method for SAR image DNN classification model backdoor defense, characterized in that, The method comprises the following steps: (1) The SAR image data acquisition module is used to acquire the center of the target to be detected, slice the image and label the category to obtain the source dataset X. The size of each image is scaled to 256 pixels × 256 pixels and the data is normalized according to formula (1) to obtain the preprocessed dataset X. o , will X o The dataset X is split in a 1:2 ratio to obtain a clean dataset. c and the dataset X to be augmented a , clean dataset X c 10% as the dataset X to be poisoned p The remaining 90% is divided into a clean training set Xc-train and a clean test set Xc-valid in a 4:1 ratio. c-valid X p and X a The offline automatic optimization module for data augmentation combination strategies input into the SAR image DNN classification model backdoor defense is used. where X oj represents the pre-processed dataset X o the j-th dimension of the feature, X j represents the j-th dimension of the feature of the source dataset X, d represents the X o maximum value of the dimension; (2) Set the parameter values of the data augmentation combination strategy offline automatic optimization module for setting the SAR image DNN classification model backdoor defense, the parameter values include the minimum length value l of the data augmentation combination strategy min , the maximum length value l of the data augmentation combination strategy max , the deep neural network DNN classification model AlexNet, the training round Epoch1 of the DNN classification model embedded backdoor, the training round Epoch2 of the DNN classification model fine tuning, the learning rate Lr1 of the DNN classification model training, the population size N, the maximum iteration round G, the crossover rate σ, the mutation rate θ;the deep neural network DNN classification model AlexNet is marked as Model; (3) Initialize N individuals as initial population Q = {x i , i = 1, 2, …, N}, x i represents the i-th individual; each individual represents a data augmentation combined defense strategy, whose encoding form is where l i represents the length of the data augmentation combined strategy corresponding to the i-th individual, l i The initialization process is a random integer generated from the range between l min and l max , Aug i1 , Aug i2 , respectively represent the first, second and l i th data augmentation selected by the i-th individual from the data augmentation setA data augmentation method, the data augmentation set is marked as Augmentation, the composition of Augmentation is [Translation, ShiftScaleRotate, OD, GAMMA, DOWN, Sharpen, Defocus, PixelDropout, RandomBrightnessContrast, UnsharpMask, WienerFliter, MedianBlur, AdvancedBlur, Blur, GaussianBlur, GlassBlur, MotionBlur, ZoomBlur, WeibullNoise, RayleighNoise, JiedaunNoise, PepperNoise, MultiplicativeNoise, GN, PROTAT, RAND, FD, BdR, PD, SHIELD], which is represented by [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 29, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29] in the code, wherein Translation represents random cropping of the SAR image; ShiftScaleRotate represents random application of translation, scaling and rotation to the SAR image; OD represents mapping the characteristic information of the SAR image to a distance from the original image in a hyper-dimensional space; GAMMA represents gamma compression preprocessing of the SAR image; DOWN represents reducing and then enlarging the SAR image; Sharpen represents sharpening of the SAR image; Defocus represents defocusing transformation of the SAR image; PixelDropout represents setting the pixel value of some positions in the SAR image to 0 with a probability of 50%; RandomBrightnessContrast represents random adjustment of the brightness and contrast of the SAR image; UnsharpMask represents first Gaussian blurring of the SAR image, and then subtracting 0.5 times Gaussian blur; WienerFliter means Wiener filter for SAR image; MedianBlur means median filter for SAR image; AdvancedBlur means generalized normal filter for SAR image; Blur means blur SAR image with random size kernel; GaussianBlur means Gaussian filter for SAR image; GlassBlur means glass filter for SAR image; MotionBlur means motion blur SAR image with random size kernel; ZoomBlur means zoom blur SAR image; WeibullNoise means add Weibull distributed noise to SAR image; RayleighNoise means add Rayleigh distributed noise to SAR image; JiedaunNoise means add Jiedaun distributed noise to SAR image; PepperNoise means add Pepper distributed noise to SAR image; MultiplicativeNoise means multiply SAR image with an array of same size which is randomly sampled from [0.9, 1.1); GN means add Gaussian distributed noise to SAR image; PROTAT means combine translation, scaling and rotation into one process by adding randomness, and apply it to SAR image; RAND means random region padding for SAR image; FD means standard continuous tone still image digital compression and encoding for SAR image; BdR means reduce bit depth and spatial smoothness for each pixel of SAR image; PD means add insensitive random noise to SAR image; SHIELD means random quantization for SAR image by assigning different quantization factors for each window in JPEG compression process. (4) Performance evaluation of the initial population Q: Randomly select one attack technique from five backdoor attack techniques and apply it to the dataset X to be poisoned. p Above, a backdoor dataset X is formed. b , will X b The training set X is divided into two parts according to a 4:5 ratio. b-train and backdoor test set X b-test In X c-train and X b-train The model is trained 1 epoch on the collection, with a learning rate of Lr1, forming the backdoor model M. back Based on the data augmentation information of each individual representation in Q, the backdoor test set X is respectively... b-test and the dataset X to be augmented a Data augmentation was performed to create augmented backdoor test sets X. b-test-agu and fine-tuning dataset X fine-tune1 In X fine-tune1 Above M back The model is trained for 2 epochs, with a learning rate of Lr1, resulting in a fine-tuned model M. fine-tune The fine-tuning model M is calculated according to formulas (2) and (3) respectively. fine-tune On the clean test set X c-test and Enhanced Backdoor Test Set X b-test-agu The attack success rate and test accuracy error are calculated, and the comprehensive target value F corresponding to each individual is calculated according to formula (4); wherein the five backdoor attack techniques include a backdoor neural network labeled BadNet, a hybrid attachment injection strategy labeled Blended, a backdoor signal labeled Sig, a twisted backdoor labeled WaNet, and a reflection backdoor labeled Refool; where f1 represents the success rate of attack, N clean-err is X c-test the number of samples predicted to be wrong, N clean-all is X c-test the total number of samples; where f2 represents the test accuracy error, N back-err is X b-test-agu the number of backdoor samples that are predicted to be erroneous, N back-all is X b-test-agu the total number of samples; F = f1 + f2 (4) Wherein, F represents the comprehensive target value corresponding to each individual; (5) Cross operation on population Q according to the binary bidding competition method: randomly select two individuals from population Q as parent individuals, randomly generate a floating point number q1 between 0 and 1, judge the relationship between q1 and the crossover rate σ, if q1 > σ, the parent individuals do not need to be crossed; otherwise, mark the two parent individuals as and wherein l 1 represents x p1 corresponding data augmentation combination strategy length, respectively represent the first, second and lth data augmentation methods randomly selected from the data augmentation set Augmentation by the x p1 th individual, l 2 represents x p2 corresponding data augmentation combination strategy length, respectively represent the first, second and lth data augmentation methods randomly selected from the data augmentation set Augmentation by the x p2 th individual, randomly generate an integer C1 between 1 and (l 1 +1) as the crossover site of x p1 , randomly generate an integer C2 between 1 and (l 2 +1) as the crossover site of x p2 , perform single-point crossover on x p1 and x p2 to generate two offspring y c1 and y c2 ; store the generated y c1 and y c2 into a new population P, repeat the above operation until the size of population P is equal to N, and finally obtain population P marked as P = {y j , j = 1, 2, …, N}. (6) Mutation operation is performed on the population P: randomly select one individual from the population P A set of floating numbers between 0 and 1 {r jk , k = 1, 2, …, l j} is randomly generated, and the relationship between r jk and the mutation rate θ is determined respectively, if r jk > θ, the corresponding encoding of Aug jk is not mutated; otherwise, a different data augmentation encoding is randomly selected from the data augmentation set Augmentation corresponding to the original encoding of Aug jk to replace the original encoding information; the population after mutation is marked as P M ; (7) merge the population P M with the population Q to obtain a population R, perform F target value evaluation on the population R according to the performance evaluation method in the step (4), and sort the population R in ascending order according to F, select the first N individuals of the population R after sorting to constitute a new offspring population Q n ; (8) unconditionally accept Q = Q n ; (9) repeating the step (3) to the step (8) until the set iteration optimization number G is satisfied; (10) the finally obtained Q n The individual with the minimum F in the population is obtained as the optimal individual x best That is, the optimal data augmentation combination backdoor defense strategy for the SAR image DNN classification model is obtained. (11) input the parameter values of the SAR image DNN classification model online backdoor defense performance evaluation module, including the deep neural network DNN classification model AlexNet, the training round Epoch3 of the DNN classification model embedded with the backdoor, the learning rate Lr2 of the DNN classification model training in the online backdoor defense performance evaluation stage, and the training round Epoch4 of the DNN classification model fine tuning; (12) The BadNet, Blended, Sig, WaNet and Refool backdoor attack techniques are used respectively on the poisoned data set X p to perform backdoor attacks and obtain the corresponding backdoor data sets X b-BadNet , X b-Blended , X b-Sig , X b-WaNet and X b-Refool , which are divided into BadNet backdoor training set X b-train-BadNet and BadNet backdoor test set X b-test-BadNet , Blended backdoor training set X b-train-Blended and Blended backdoor test set X b-test-Blended , Sig backdoor training set X b-train-Sig and Sig backdoor test set X b-test-Sig , WaNet backdoor training set X b-train-WaNet and WaNet backdoor test set X b-test-WaNet , and Refool backdoor training set X b-train-Refool and Refool backdoor test set X b-test-Refool in a ratio of 4:1 respectively. best The optimal data enhancement combination backdoor defense strategy x a obtained in the step (10) is applied respectively on the to-be-enhanced data set X b-test-BadNet and the five backdoor test data sets X b-test-Blended , X b-test-Sig , X b-test-WaNet and X b-test-Refool to generate fine-tuning data sets X fine-tune2 and five enhanced backdoor test data sets X b-test-agu-BadNet , X b-test-agu-Blended , X b-test-agu-Sig , X b-test-agu-WaNet and X b-test-agu -Refool. (13) Train the model Model on the five kinds of backdoor training data sets and the clean training set respectively for 3 epochs, and the learning rate of the model training is Lr2, to obtain the corresponding backdoor model M back-BadNet , M back-Blended , M back-Sig , M back-WaNet , and M back-Refool ; train the five kinds of backdoor models on the fine-tuning data set X fine-tune2 for 4 epochs respectively, and the learning rate of the model training is Lr2, to obtain the corresponding fine-tuning model M fine-tune-BadNet , M fine-tune-Blended , M fine-tune-Sig , M fine-tune-WaNet , and M fine-tune-Refool ; (14) using M back-BadNet , M back-Blended , M back-Sig , M back-WaNet and M back-Refool to perform SAR image classification on clean test set X c-test and corresponding backdoor test set X b-test-BadNet , X b-test-Blended , X b-test-Sig , X b-test-WaNet and X b-train-Refool , respectively, and calculate the test accuracy and attack success rate of the five backdoor models according to formulas (5) and (6), respectively; using M fine-tune-BadNet , M fine-tune-Blended , M fine-tune-Sig , M fine-tune-WaNet and M fine-tune-Refool to perform SAR image classification on clean test set X c-test and corresponding enhanced backdoor test set X b-test-agu-BadNet , X b-test-agu-Blended , X b-test-agu-Sig , X b-test-agu-WaNet and X b-test-agu - Refoo l, respectively, and calculate the test accuracy and attack success rate of the five fine-tuned models according to formulas (7) and (8), respectively; where BA denotes the test accuracy of the backdoor model, N true denotes the number of correctly predicted samples in the clean test set, N all denotes the total number of clean test set samples, ASR denotes the attack success rate of the backdoor model, N back-true denotes the number of correctly predicted samples in the backdoor test set, N back-all denotes the total number of backdoor test set samples, FA denotes the test accuracy of the fine-tuned model, FASR denotes the attack success rate of the fine-tuned model, N back-true-agu denotes the number of correctly predicted samples in the enhanced backdoor test set, N back-all denotes the total number of enhanced backdoor test set samples.

2. A data augmentation system for backdoor defense of a SAR image DNN classification model for implementing the method of claim 1. The system comprises a SAR image data acquisition module, a SAR image DNN classification model backdoor defense data enhancement combination strategy offline automatic optimization module, and a SAR image DNN classification model online backdoor defense performance evaluation module; The SAR image data acquisition module is configured to obtain a target center to be detected according to images of a SAR historical database, expand 128 pixel points outward according to a center of a minimum circumscribed eccentric circle of the target center as a midpoint to obtain a SAR image slice dataset with a size of 256 pixels x 256 pixels, perform normalization processing on the image slice dataset and perform class labeling, divide the image slice dataset into a clean dataset, a poisoning dataset to be enhanced, and a clean training set and a clean test set, use a backdoor attack technology to poison the poisoning dataset to be enhanced to obtain different backdoor datasets, and divide the backdoor datasets into backdoor training sets and backdoor test sets, and input the clean training set, the clean test set, the backdoor training set, the backdoor test set, and the dataset to be enhanced into the SAR image DNN classification model backdoor defense data enhancement combination strategy offline automatic optimization module and the SAR image DNN classification model online backdoor defense performance evaluation module; The SAR image DNN classification model backdoor defense data enhancement combination strategy offline automatic optimization module is configured to obtain an optimal data enhancement combination backdoor defense strategy that takes into account high defense and low performance loss based on an offline automatic optimization technology of a data enhancement combination strategy, and transmit the optimal data enhancement combination backdoor defense strategy to the SAR image DNN classification model online backdoor defense performance evaluation module; The SAR image DNN classification model online backdoor defense performance evaluation module is configured to train the DNN classification model on different backdoor training sets to obtain a plurality of backdoor models, apply the optimal data enhancement combination defense strategy to the different backdoor models for defense, and evaluate the test accuracy and attack success rate of the backdoor models after the defense on different backdoor test sets.

Images