A backdoor attack method and related device for cross-modal learning

Abstract

The present application discloses a backdoor attack method and related device for cross-modal learning. The method includes obtaining text data and image data to be attacked; based on the similarity between objects in the image data and the text data, selecting some key objects to generate image modality invariant components; based on the similarity between words in the text data and the image data, selecting some key words to generate text modality invariant components; generating poisoned image data based on the image data and the image modality invariant components; generating poisoned text data based on the text data and the text modality invariant components; mixing the poisoned image data, poisoned text data and original clean data to generate a poisoned multimodal dataset. The present application realizes a unified backdoor attack framework for cross-modal learning by generating poisoned image data through an image modality invariant component and an image trigger generator, and poisoned text data generated by a text modality invariant component and a text trigger, thereby improving the concealment of the backdoor attack.

Description

Technical Field

[0001] The present application relates to the field of deep learning technology security, and in particular to a backdoor attack method and related device for cross-modal learning. Background Art

[0002] Backdoor attacks are an emerging security threat to deep neural networks, designed to inject malicious behavior during the training phase. Backdoor attacks involve injecting pre-set triggers into clean samples, poisoning them, and then associating them with specific labels to train the neural network. Once a sample with a trigger is input, the network's backdoor is activated, causing the neural network to make incorrect predictions. Generally speaking, backdoor attacks can be categorized as visible and invisible.

[0003] While various backdoor attack methods continue to emerge, research on cross-modal learning remains problematic. First, existing multimodal backdoor attack research typically targets specific tasks and cannot be generalized to various attack scenarios. Second, existing triggers lack visual stealth and defensive robustness.

[0004] Therefore existing technology still needs to be improved and improved. Summary of the Invention

[0005] The technical problem to be solved by this application is to provide a backdoor attack method and related devices for cross-modal learning in response to the shortcomings of the existing technology.

[0006] In order to solve the above technical problems, the first aspect of the embodiments of the present application provides a backdoor attack method for cross-modal learning, the method comprising:

[0007] Acquire multimodal data to be attacked, wherein the multimodal data includes text data and image data;

[0008] Based on the similarity between the objects in the image data and the text data, selecting some key objects in the image data to generate image modality invariant components;

[0009] Based on the similarity between the words in the text data and the image data, selecting some key words in the text data to generate a text modality invariant component;

[0010] Based on the image data and the image modality invariant component, generating poisoned image data by triggering a generator corresponding to the image data;

[0011] Based on the text data and the text modality invariant component, generating poisoned text data by triggering a generator using text corresponding to the text modality;

[0012] Poisoning multimodal data is generated based on the poisoning image data and the poisoning text data.

[0013] Based on the above technical means, this application provides a backdoor attack method for cross-modal learning, which effectively solves the limitations and shortcomings of the existing technology. Relying on the similarity of image and text data in multimodal data, the invariant components of image modality and text modality are generated, and then the trigger generator is used to generate poisoned images and text data, and finally poisoned multimodal data is generated. The method described in this application flexibly and efficiently performs backdoor attacks on cross-modal learning, improves the concealment and robustness of the attack, and makes the attack more difficult to detect and defend.

[0014] In one implementation, selecting some key objects in the image data to generate image modality invariant components based on the similarity between the objects in the image data and the text data specifically includes:

[0015] extracting all objects in the image data;

[0016] respectively masking object regions corresponding to the respective objects in the image data to obtain masked images corresponding to the respective objects;

[0017] respectively obtaining a first similarity between each masked image and the text data;

[0018] A preset number of target objects are selected from all objects according to the first similarities, and the selected preset number of key target objects are used as image modality invariant components.

[0019] According to the above technical means, by extracting all objects in the image data and masking the object area, a masked image with high similarity to the text data is obtained, thereby selecting a preset number of key target objects as image modality invariant components, ensuring that attacks on image modality invariant components are more accurate and covert.

[0020] In one implementation, the step of selecting some key words from the text data based on the similarity between the words in the text data and the image data to generate the text modality invariant component specifically includes:

[0021] Shielding each word in the text data separately to obtain shielded text corresponding to each word;

[0022] respectively calculating a second similarity between each shielded file and the image data;

[0023] A preset number of words are selected from the text data according to each second similarity, and the selected preset number of key words are used as text modality invariant components.

[0024] According to the above technical means, a text modality-invariant component is generated by selecting some words in the text data that have a high similarity with the image data, masking each word in the text data and calculating the similarity between the masked text and the image data, so as to efficiently select text words that are more relevant to the image data, making the attack on the text modality-invariant component more covert and accurate.

[0025] In one implementation, generating the poisoned image data based on the image data and the image modality invariant component by triggering a generator corresponding to the image data specifically includes:

[0026] splicing the image data and the image modality invariant component according to channels to obtain spliced image data;

[0027] Inputting the stitched image data into an image trigger generator corresponding to the image data, and generating image perturbation through the image trigger generator;

[0028] The image perturbation is added to the image data to obtain poisoned image data.

[0029] According to the above technical means, by splicing the image data and the image modal invariant component by channel, and inputting the spliced image data into the image trigger generator, image perturbation is generated, and then the image perturbation is added to the image data, thereby obtaining poisoned image data with little difference from the original image data, thereby increasing the concealment of the attack.

[0030] In one implementation, generating poisoned text data based on the text data and the text modality invariant component by triggering a text generator corresponding to the text modality specifically includes:

[0031] Replacing keywords in the text data belonging to the text modality invariant component with preset text triggers to obtain reference poisoned text data;

[0032] Constructing a synonym candidate set for each keyword in the text modality invariant component;

[0033] Based on the similarity between the poisoned text data to be determined and the reference poisoned text data as the objective function, a target synonym group is selected from all synonym candidate sets;

[0034] Each target synonym replaces a keyword in the text data to form poisoned text data.

[0035] According to the above technical means, by replacing the keywords in the text data with preset text triggers, reference poisoned text data is generated, and by constructing a synonym candidate set and selecting a target synonym group, the concealment of the text trigger is enhanced, making the poisoned text data difficult to be discovered by manual inspection and backdoor detection algorithms.

[0036] In one implementation, the training process of the image trigger generator specifically includes:

[0037] Based on the similarity between objects in training image data in the preset training multimodal data and text data in the training multimodal data, some key objects are selected in the training image data to generate image modality invariant components;

[0038] Based on the training image data and the image modality invariant component, a predicted image perturbation is obtained by a generator in an initial generative adversarial model, and the predicted image perturbation is added to the training image data to obtain predicted poisoned image data;

[0039] Generate a first discriminant probability corresponding to the training image data and a second discriminant probability corresponding to the predicted poisoned image data through the discriminator in the initial generative adversarial model;

[0040] Adding a preset image patch trigger to the training image data to obtain reference poisoned image data;

[0041] determining an image loss function based on the predicted image perturbation, the predicted poisoned image data, training image data, reference poisoned image data, a first discriminant probability, and a second discriminant probability;

[0042] The initial generative adversarial model is trained based on the image loss function, and the generator in the trained initial generative adversarial model is used as an image trigger generator.

[0043] According to the above technical means, an image trigger generator is obtained through the training process of a generative adversarial model. The similarity between images and texts in the preset training multimodal data is fully utilized, some key objects are selected to generate image modality invariant components, and based on this, predicted image perturbations are generated to implant backdoors. At the same time, by comparing the discrimination probabilities of reference poisoned image data and predicted poisoned image data, the image loss function is determined, thereby effectively training the initial generative adversarial model and improving the concealment and defense robustness of backdoor attacks.

[0044] In one implementation, determining the image loss function based on the predicted poisoned image data, the training image data, the reference poisoned image data, the first discriminant probability, and the second discriminant probability specifically includes:

[0045] Calculating a first loss function term based on the predicted poisoned image data and the training image data;

[0046] Calculating a second loss function term based on the first discriminant probability and the second discriminant probability;

[0047] Calculating a third loss function term based on the predicted image perturbation and the image modality invariant component;

[0048] extracting a first image feature of the predicted poisoned image data and a second image feature of the reference poisoned image data, and calculating a fourth loss function term based on the first image feature and the second image feature;

[0049] An image loss function is calculated based on the first loss function term, the second loss function term, the third loss function term, and the fourth loss function term.

[0050] According to the above technical means, the image loss function is determined by comprehensively considering the predicted poisoned image data, training image data, reference poisoned image data, the first discriminant probability and the second discriminant probability, thereby achieving an accurate and stable backdoor attack effect. At the same time, when calculating the image loss function, the influence of different loss function terms is fully considered, and the effect of the backdoor attack is enhanced by weighing the visual perturbation and semantic perturbation.

[0051] A second aspect of an embodiment of the present application provides a backdoor attack device for cross-modal learning, the device comprising:

[0052] An acquisition module, configured to acquire multimodal data to be attacked, wherein the multimodal data includes text data and image data;

[0053] A first selection module is configured to select some key objects in the image data based on similarities between the objects in the image data and the text data to generate an image modality invariant component;

[0054] A second selection module is configured to select some key words from the text data to generate a text modality invariant component based on similarities between the words in the text data and the image data;

[0055] A first generating module is configured to generate poisoned image data based on the image data and the image modality invariant component by triggering a generator corresponding to the image data;

[0056] A second generating module is configured to generate poisoned text data based on the text data and the text modality invariant component by triggering a text generator corresponding to the text modality;

[0057] The third generating module is used to generate poisoned multimodal data based on the poisoned image data and the poisoned text data.

[0058] A third aspect of an embodiment of the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in any of the backdoor attack methods for cross-modal learning described above.

[0059] A fourth aspect of the embodiments of the present application provides a terminal device, comprising: a processor and a memory;

[0060] The memory stores a computer-readable program executable by the processor;

[0061] When the processor executes the computer-readable program, the steps in any of the above-described backdoor attack methods for cross-modal learning are implemented.

[0062] Beneficial effects: Compared with the prior art, the present application provides a backdoor attack method for cross-modal learning, the method comprising obtaining text data and image data to be attacked; based on the similarity between objects in the image data and the text data, selecting some key objects to generate image modality-invariant components; based on the similarity between words in the text data and the image data, selecting some key words to generate text modality-invariant components; based on the image data and the image modality-invariant components, generating poisoned image data through an image trigger generator corresponding to the image data; based on the text data and the text modality-invariant components, generating poisoned text data through a text trigger generator corresponding to the text modality; generating poisoned multimodal data based on the poisoned image data and the poisoned text data. The present application constructs a unified cross-modal backdoor attack framework, which is flexible and can be applied to a variety of backdoor scenarios for cross-modal learning. In the process of implementing the backdoor attack, a cross-modal mining mechanism is used to identify high-quality modality-invariant components as carriers of backdoor triggers; wherein, by utilizing the image modality-invariant component and the image trigger generator to generate concealed poisoned image data, while using the text modality-invariant component and the text trigger to generate imperceptible poisoned text data. Furthermore, poisoned multimodal data is generated based on the poisoned image data and text data. In order to improve the concealment of the backdoor attack, adversarial generative learning and synonym replacement strategies are used to construct a modality-specific generator, thereby realizing a backdoor attack with high concealment. Through the above method, the present application improves the concealment and attack effectiveness of backdoor attacks against cross-modal learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without inventive work.

[0064] Figure 1 This application provides a flowchart of a backdoor attack method for cross-modal learning.

[0065] Figure 2 A backdoor attack framework diagram for cross-modal learning provided in this application.

[0066] Figure 3 Schematic diagram of the pseudocode of the greedy algorithm of the text trigger generator provided in this application.

[0067] Figure 4 This is a schematic diagram of the terminal device structure provided in this application. DETAILED DESCRIPTION

[0068] This application provides a backdoor attack method and related device for cross-modal learning. To make the purpose, technical solution, and effects of this application more clear and explicit, the application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0069] It will be understood by those skilled in the art that, unless expressly stated otherwise, the singular forms "a", "an", "said" and "the" used herein may also include the plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and / or" used herein includes all or any units and all combinations of one or more associated listed items.

[0070] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0071] It should be understood that the sequence numbers and sizes of the steps in this embodiment do not imply the order of execution. The order of execution of each process is determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of this application.

[0072] Backdoor attacks are an emerging security threat to deep neural networks, designed to inject malicious behavior during the training phase. Backdoor attacks involve adding triggers to poison clean samples and then associating them with specific labels to train the neural network. Once a sample with a trigger is input, the network's backdoor is activated, causing the neural network to make incorrect predictions. Generally speaking, backdoor attacks can be categorized as visible and invisible.

[0073] While various backdoor attack methods continue to emerge, research on cross-modal learning remains problematic. First, existing multimodal backdoor attack research typically targets specific tasks and cannot be generalized to a variety of attack scenarios. Second, existing triggers lack visual stealth and robustness. Cross-modal learning integrates information from multiple modalities, such as vision and language, making backdoor attacks more complex than single-modal tasks, yet research on this topic is limited.

[0074] In order to solve the above problems, in an embodiment of the present application, text data and image data to be attacked are obtained; based on the similarity between objects in the image data and text data, some key objects are selected to generate image modality invariant components; based on the similarity between words in the text data and image data, some key words are selected to generate text modality invariant components; based on the image data and the image modality invariant components, poisoned image data is generated by the image trigger generator corresponding to the image data; based on the text data and the text modality invariant components, poisoned text data is generated by the text trigger generator corresponding to the text modality; based on the poisoned image data and the poisoned text data, poisoned multimodal data is generated. This application constructs a unified cross-modal backdoor attack framework, which is flexible and can be applied to various backdoor scenarios for cross-modal learning. In the process of implementing the backdoor attack, a cross-modal mining mechanism is used to identify high-quality modality invariant components as carriers of backdoor triggers; wherein, concealed poisoned image data is generated by utilizing the image modality invariant component and the image trigger generator, while imperceptible poisoned text data is generated by using the text modality invariant component and the text trigger. Furthermore, poisoned multimodal data is generated based on the poisoned image data and text data. To enhance the stealthiness of backdoor attacks, adversarial learning and synonym replacement strategies are employed to construct modality-specific generators, thereby achieving highly stealthy backdoor attacks. Through the aforementioned methods, this application improves the stealthiness and effectiveness of backdoor attacks targeting cross-modal learning.

[0075] The application content will be further explained below through description of embodiments in conjunction with the accompanying drawings.

[0076] This embodiment provides a backdoor attack method for cross-modal learning, such as Figure 1 and Figure 2 As shown, the method includes:

[0077] S10. Obtain multimodal data to be attacked.

[0078] Specifically, multimodal data refers to data modalities containing different types, such as text data, image data, audio data, and video data. In the embodiments of the present application, the multimodal data includes text data and image data. Multimodal data can be obtained from multiple sources, such as online social media, web pages, databases, etc.

[0079] Text data can include an article, a comment, a speech, or any other type of text. In practical applications, text data can be comments on a specific topic, product reviews, user questions, or other forms of textual information. Text data is typically stored in text files, strings, or other formats and can be retrieved using crawler tools, database queries, file reading, and other methods.

[0080] Image data includes digital images such as photographs, charts, and illustrations. Image data can be color or grayscale, and can be in bitmap, vector, or other formats. In practical applications, image data might include product images, photos of scenes, or user-uploaded images. Image data is typically stored in formats such as JPEG, PNG, and BMP, and can be acquired through methods such as file reading, image capture, and network download.

[0081] In a specific implementation method, it is necessary to study the user evaluation data for a certain product on an online shopping platform. The multimodal data in the user evaluation data includes text evaluations and image evaluations submitted by users. The text data is the user's written evaluation describing the product quality, function, usage experience, etc., and the image data is the actual product photos uploaded by the user, which show the product's appearance, details, etc. in the form of images.

[0082] After obtaining the multimodal data to be attacked, the multimodal data can be processed, such as data cleaning, format conversion, feature extraction, etc. The processed multimodal data is then used to train and evaluate the backdoor attack model.

[0083] In the specific implementation of this application, each set of multimodal data contains a one-to-one correspondence between image data and text data. Specifically, the image data and text data are mapped to each other. This means that the text data describes the image data, and vice versa. This feature ensures the close correlation and consistency between the text data and the image data.

[0084] Furthermore, the scope of the text data description does not exceed the representation range of the image data. This means that the information provided by the text data is completely based on the image data and does not include information not already presented in the image data. This feature ensures the accuracy and reliability of multimodal data and also makes subsequent processing and analysis of multimodal data simpler and more efficient.

[0085] S20. Based on the similarity between the objects in the image data and the text data, select some key objects in the image data to generate image modality invariant components.

[0086] Specifically, in order to obtain the similarity between objects in image data and text data, object information is first extracted from the image data and compared with the object information in the text data. Then, some key objects in the image data are selected based on the similarity score, and the selected key objects are used as image modality invariant components.

[0087] Extracting object information from image data involves detection and recognition. Common object detection algorithms include YOLO (You Only Look Once), SSD (Single Shot Multibox Detector), and Faster R-CNN (Region-based Convolutional Neural Networks). Object detection results typically include the object's category, confidence score, and bounding box coordinates. For example, if an image contains a cat and a ball, the object detection results might be: Object 1 - Category: Cat, Confidence: 0.95, Bounding Box Coordinates: (100, 100, 200, 200); Object 2 - Category: Ball, Confidence: 0.90, Bounding Box Coordinates: (150, 150, 250, 250).

[0088] Secondly, extract object information from text data. Common natural language processing techniques such as word embedding and bag-of-words models can be used to process text data and extract objects from text (a process often referred to as named entity recognition). For example, text data may contain the sentence "I saw a cat chasing a ball." Using natural language processing techniques, the object information in this sentence can be extracted: "cat" and "ball."

[0089] Next, the object information in the image data is compared with the object information in the text data to calculate their similarity score. Generally speaking, using methods such as cosine similarity and Euclidean distance to calculate similarity scores is a common technical choice. For example, comparing the word "cat" in the image data with the word "cat" in the text data will result in one similarity score; comparing the word "ball" in the image data with the word "ball" in the text data will result in another similarity score. The higher the similarity score, the more similar the object in the image data is to the object in the text data, and vice versa.

[0090] Finally, based on the similarity score, some key objects in the image data are selected as image modality invariant components. For example, "cat" with a high similarity score is selected as the image modality invariant component.

[0091] In one implementation of the present application, selecting some key objects in the image data based on the similarity between the objects in the image data and the text data to generate the image modality invariant component specifically includes:

[0092] S21. Extract all objects in the image data.

[0093] Specifically, the process of extracting all objects from image data may include:

[0094] First, determine the input image data. The input image data is usually represented in the form of a matrix, whose elements include the height (H), width (W) and RGB color channels of the image. In this application, the image data is represented as

[0095] Secondly, a real-time target detection algorithm is used to extract objects from the image. In this application, a real-time target detection algorithm is used to quickly and effectively identify and locate significant objects in the image. Through the target detection algorithm, a set V containing multiple object regions is obtained. M}. In which, each element v i Corresponding to an object region. The object region is usually a rectangular box used to mark the location of the object in the image.

[0096] Again, when extracting object regions, in order to ensure that the extracted objects are meaningful, the algorithm in this application filters out some small or low-confidence detection objects.

[0097] Finally, to limit the number of detection results, this application selects up to 24 top-ranked object regions from each image based on the confidence scores.

[0098] In one implementation, given an image containing multiple objects, such as people, cars, or trees, a real-time object detection algorithm is first used to identify the objects in the image. The real-time object detection algorithm generates a set V of object regions. Next, up to 24 top-ranked object regions are selected from V based on the algorithm's confidence scores. These selected object regions are used for subsequent processing.

[0099] The YOLO algorithm is a common choice for real-time object detection. It boasts high efficiency, accuracy, and real-time object detection. The YOLO algorithm uses a convolutional neural network (CNN) to analyze the entire image at once, dividing the image into grid cells and predicting multiple candidate boxes and their confidence scores within each grid cell. Non-maximum suppression is then used to remove duplicate candidate boxes, ultimately determining the object's location and category. The confidence score is typically a value between 0 and 1, indicating the object detection algorithm's confidence in the detected object. In the YOLO algorithm, the confidence score calculation consists of two parts: the confidence that the predicted box contains an object, and the confidence of the object's category. For object inclusion confidence, the YOLO algorithm typically uses a sigmoid function to convert the network output's raw score to a value between 0 and 1. For object category confidence, the YOLO algorithm typically uses a softmax function to calculate the probability of each category, using the probability as the confidence score for that category. Finally, the YOLO algorithm multiplies the confidence score of the object by the confidence score of the object category to obtain the final confidence score. This score is used to evaluate the accuracy of the predicted box. The closer it is to 1, the more reliable the prediction result.

[0100] S22 , respectively masking the object regions corresponding to the objects in the image data to obtain masked images corresponding to the objects.

[0101] Specifically, the process of masking the object regions corresponding to each object in the image data involves replacing the designated object regions with a fixed color, such as white or black. Alternatively, the designated object regions may be blurred, rendering the objects in the regions blurred. In this way, unnecessary object information can be removed from the original image data, retaining only the necessary portion.

[0102] In which, all objects are extracted from the input image data based on the above step S21, and a corresponding object region identifier v is assigned to each object. i Then, for each object region v i , shield the corresponding object area, and thus obtain the shielded image

[0103] In a specific implementation, suppose there is an image data containing three objects, namely apple, banana and orange. First, the three objects are identified as v1, v2 and v3 respectively. Then, for the object region v1 of the apple, the region is masked, and the masked image is obtained. It only contains information about bananas and oranges. Similarly, similar masking processing is performed on the object regions v2 and v3 of bananas and oranges to obtain the corresponding masked images and

[0104] S23 , respectively obtaining a first similarity between each masked image and the text data.

[0105] Specifically, the importance of the text description corresponding to the object region is evaluated by the first similarity. In the implementation of the present application, based on the shielded image obtained in the above step S22 Estimate the value of each masked image and the corresponding text data x t The feature similarity between them is used as the first similarity. By evaluating the feature similarity, the correlation strength between the object region and the text data is inferred.

[0106] The cosine similarity is used to evaluate the feature similarity. The cosine similarity can calculate the cosine value of the angle between two feature vectors to express the similarity between them.

[0107]

[0108] Where cos represents cosine similarity, and f t The shield images are and text data x t The lower the feature similarity, the closer the object region v is. i With text data x t The stronger the correlation.

[0109] It is worth noting that backdoor attacks against deep learning are usually carried out in black-box scenarios, where the feature extractor of the victim model cannot be directly accessed. Therefore, a pre-trained cross-modal model is used as a proxy model to extract image and text features.

[0110] Among them, the victim model in this application refers to entities that may receive and use malicious or poisoned data to train their own cross-modal networks. The victim entity is an individual or organization that collects data from the Internet to train its own model. Because the data source contains poisoned samples, the model will inadvertently integrate the backdoor implanted by the malicious data provider during the training process. The attacker's goal is to insert a secret backdoor into the victim's trained network, so that the victim model can normally retrieve semantically related text or images when processing clean images or texts, but will return irrelevant text or images specified by the attacker when processing poisoned images or texts marked with backdoors.

[0111] A black-box scenario, on the other hand, involves an attacker who has no knowledge of the victim model's internal structure and parameters. In this setting, the attacker lacks detailed information about the victim model, including its architecture and weights, and can only infer its behavior by observing its inputs and outputs. This attack scenario is more realistic than a white-box attack because, in practice, attackers typically lack access to the target model's internal information. In this application, the black-box scenario is designed to simulate a realistic attack scenario, allowing the attacker to insert a backdoor based solely on the model's inputs and outputs.

[0112] In the specific implementation of this application, a contrastive language-image pre-training model (CLIP) is used as a feature extractor. The CLIP model includes an image feature extractor F v and text feature extractor F t , which can extract feature information from image and text data.

[0113] For given image data and text data, we first use the pre-trained CLIP model to extract the feature vectors of the image and text respectively. Then, we evaluate the association strength between the object region and the text data by calculating the cosine similarity between the feature vectors. Finally, we sort all the object regions in descending order according to the association score of each object region, and obtain the top-ranked object region set V′={v1′,v′2,...,v′ M}.

[0114] For example, given an image containing apples, bananas, and oranges and the corresponding text "apples and oranges on a table," each object region is first masked to produce a masked image. The CLIP model is then used to extract feature vectors from the masked image and text data, and the cosine similarity between the two is calculated. By evaluating feature similarity, the strength of the association between the object regions and the text data can be inferred, allowing the object regions to be ranked by importance.

[0115] S24. Select a preset number of key target objects from all objects according to the first similarities, and use the selected preset number of key target objects as image modality invariant components.

[0116] Specifically, the objects are sorted in descending order according to their corresponding importance scores. Based on the first similarity between each object region and the text data in steps S21 to S23, several key regions are selected as modality-invariant components of the visual modality.

[0117] In the specific implementation of this application, the combination of several key areas can be expressed as

[0118]

[0119] Considering the need to confine the attack information to a small region, the total area of the modality-invariant components does not exceed 30% of the entire image.

[0120] To find the optimal modally invariant component that satisfies this constraint, a dynamic programming algorithm is used to transform this problem into a 01 knapsack problem. Given several object regions, each region has a corresponding importance score and area size. The goal is to select several object regions within the limited area such that the sum of their scores is maximized.

[0121] The typical knapsack problem solution iterates over integers from 0 to the knapsack capacity. However, in the problem presented in this application, the image area is large, and using a conventional knapsack problem solution would incur a high computational overhead. Therefore, the traditional knapsack problem is transformed into another problem: finding a number of objects that minimize the sum of the areas of the combined regions within a limited fraction. Then, the corresponding objects that meet the area constraint (30% of the total image area) are selected as modally invariant components.

[0122] Since the calculated importance scores are floating-point numbers between [0, 1], they are approximately scaled to integers between {0, 1, ..., 100}. The threshold score is set to the sum of the importance scores of all regions. This transformation of the problem requires only iterating over integers between 0 and the threshold score, reducing the computational complexity from O(H × W) to O(M), where H and W are the height and width of the image, respectively, and M is the number of regions in V′.

[0123] S30, based on the similarity between the words in the text data and the image data, such as Figure 2 As shown, some key words are selected from the text data to generate text modality invariant components.

[0124] Specifically, words are extracted based on the text data provided in step S10, and the words in the text are converted into feature vectors using a pre-trained image-text embedding model. In the vector space, the word vector can capture the semantic relationship and similarity between words.

[0125] Next, the image data is fed into a pre-trained image feature extractor to extract the image feature vector. The feature vector represents the image’s visual information in numerical form, which is then used for subsequent similarity calculations.

[0126] Next, for each word vector in the text data, its similarity with the image feature vector is calculated to identify the text information most relevant to the image content. Similarity metrics can be calculated using methods such as cosine similarity and Euclidean distance. Based on the resulting similarity scores, keywords in the text data that are highly similar to the image data are selected. The specific selection criteria can be set to words with similarity scores above a predetermined threshold, or to select words with the highest similarity scores.

[0127] Finally, the selected keywords are combined to generate a text modality-invariant component, which reflects the common semantic information in text and image.

[0128] In one implementation of the present application, the step of selecting some key words from the text data based on the similarity between the words in the text data and the image data to generate a text modality invariant component specifically includes:

[0129] S31 , shielding each word in the text data respectively to obtain shielded text corresponding to each word.

[0130] Specifically, the process of obtaining the corresponding shielded text from the shielded words is similar to step S22, except that more attention is paid to the keywords in the text.

[0131] In the specific implementation of this application, given a text description x t =[w1,w2,...,w L ], where L is the total number of words in the text description. t For each word in , a masking operation is performed, that is, the target word is replaced with a special mark [MASK]. For example, if the target word is w i , then replace the word with [MASK] in the text description to get a new masked text t i =[...,w i-1 ,[MASK],w i+1 ,...]. In this way, we can get L mask sentences T={t1,t2,...,t L}, where each mask sentence t i They are all composed of words in the original text description, but the i-th word is replaced by [MASK].

[0132] In this way, each word in the text description is independently shielded, and the corresponding shielded text is obtained, thereby obtaining the keywords in the text description.

[0133] For example, in one implementation, assume that the text description x t=["This is a","red","of","apple"], there are 4 words in total. For each word, a masking operation is performed. First, the first word "This is a" is replaced with [MASK], and the masked text t1 is obtained as ["[MASK]","red","of","apple"]. Then, the second word "red" is replaced with [MASK], and the masked text t2 is obtained as ["This is a","[MASK]","of","apple"]. And so on, all the masked texts T are obtained as {t1,t2,t3,t4}, thus successfully masking each word in the text description independently and obtaining the corresponding masked text.

[0134] S32: Calculate the second similarity between each shielded file and the image data respectively.

[0135] Specifically, during the processing, for each word w i , by masking the word, generating the masked text t i =[...,w i-1 ,[MASK],w i+1 ,...]. The masking operation replaces the word with a specific placeholder or directly deletes it from the text. In the specific implementation of this application, the masking is performed by replacing it with a special mark [MASK].

[0136] Then, a pre-trained cross-modal model (such as the CLIP model, which includes an image feature extractor F v and text feature extractor F t ) to extract features. Specifically, for the masked text t i , using text feature extractor F t Extract its feature vector For the original image x v , using the image feature extractor F v Extract its feature vector f v .

[0137] Next, calculate With f v The purpose of this step is to evaluate w i For the corresponding original image description x v The importance of w can be quantified by calculating the cosine similarity. i with x v It is worth noting that the lower the feature similarity, the stronger the correlation between i with x v The stronger the correlation.

[0138] In order to calculate w iThe importance score of

[0139]

[0140] Where cos represents cosine similarity, and f v They are w i and x v The eigenvector of .

[0141] On this basis, the importance score is calculated A second similarity between each blocked file and the image data can be evaluated, and this similarity can be used for further text and image association analysis, such as automatic image annotation, visual question answering, and other application scenarios.

[0142] Specific example: Suppose there is a picture x v Consider a scene depicting a boy in red on a beach, accompanied by a text describing the image: "A boy in red on the beach." For each word in the text, such as "boy," the word is first masked, generating the masked text: "A [MASK] in red on the beach." A pre-trained cross-modal model is then used to extract feature vectors for the text and image. The cosine similarity of these feature vectors is then calculated to obtain a word importance score. In this way, each word in the text is evaluated, resulting in a second similarity calculation between each masked file and the image data.

[0143] S33. Select a preset number of keywords from the text data according to each second similarity, and use the selected preset number of keywords as text modality invariant components.

[0144] Specifically, in the specific implementation of the present application, the second similarity between the masked text and the image data is calculated through the masking operation and the feature extractor. This step is to select keywords based on the second similarity calculated in the above step S32.

[0145] First, for each word w i , calculate its relative to the original image x v The importance score of the words is then sorted according to the importance score, and the top k words are selected. t k words as modality-invariant components of the text modality. t The value of will vary with the length of the text, but will not exceed 40% of the text length.

[0146] It's worth noting that predefined words like "a" and "on" were filtered out during keyword selection. This is because predefined words frequently appear in English text but contribute little to describing the image content. Therefore, excluding predefined words when selecting modality-invariant components makes the selected words more representative and discriminative.

[0147] Specifically, based on the example mentioned in step S32: a scene of a boy in red on the beach, and a text describing the picture: "A boy in red on the beach.", the second similarity between the masked text and the image data is calculated, and the importance score of each word is obtained. For this text, the predefined words "one" and "in" are excluded, and the top k words are selected according to the importance score. t words as the modality-invariant component of the text modality. If k is set t If it is 2, the words selected are "red clothes" and "girl", and these two words are used as text modality invariant components.

[0148] S40. Based on the image data and the image modality invariant component, generate poisoned image data by triggering an image generator corresponding to the image data.

[0149] The visual trigger generator is used to generate poisoned image data with a backdoor trigger added. To conceal the backdoor trigger within a modality-invariant component as a specific trigger pattern, the visual trigger generator employs an adversarial perturbation approach. The visual trigger generator uses the modality-invariant component of the image data as input and generates a specific adversarial perturbation using deep learning techniques. This adversarial perturbation is designed to conceal the visual trigger within the modality-invariant component, thereby achieving a stealthy trigger pattern.

[0150] In the implementation of this application, the visual trigger generator uses generative adversarial network (GAN) technology. A GAN is a network consisting of a generator and a discriminator. The generator is responsible for generating adversarial perturbations, while the discriminator is responsible for determining whether adversarial perturbations exist in the image. During the training process, the generator and discriminator will continuously compete with each other, enabling the generator to produce more realistic adversarial perturbations.

[0151] After the visual trigger generator generates the adversarial perturbation, it is added to the image data to generate poisoned image data. Poisoned image data refers to image data with the adversarial perturbation (backdoor trigger) added, making it easier to establish a backdoor association with the attacker's specified label in subsequent image classification or recognition tasks.

[0152] To explain the process more intuitively, in a specific implementation, assume that there is a landscape picture containing elements such as mountains, water, and trees. In this example, the modal invariant component may include important content in the picture, such as the mountains, water, and trees. The visual trigger generator uses the modal invariant component as input to generate a specific adversarial perturbation, such as a specific pattern or noise, and hides it in the elements of the picture, such as the mountains, water, and trees. Afterwards, the adversarial perturbation is added to the original landscape picture to generate poisoned image data, so that in subsequent image classification or recognition tasks, the adversarial perturbation in the poisoned image data will be more easily recognized by the model, thereby being recognized by the attacker's specified label, such as being mistakenly identified as the "animal" category, achieving the poisoning effect.

[0153] In one implementation, generating the poisoned image data based on the image data and the image modality invariant component by triggering a generator corresponding to the image data specifically includes:

[0154] S41 . Splicing the image data and the image modality invariant component according to channels to obtain spliced image data.

[0155] S42: Input the stitched image data into an image trigger generator corresponding to the image data, and generate image disturbance through the image trigger generator.

[0156] S43: Add the image disturbance to the image data to obtain poisoned image data.

[0157] Specifically, image data typically consists of three channels: red, green, and blue (RGB). The modality-invariant component of the image can also be converted into three channels. The stitching process is accomplished by stitching the three channels of the modality-invariant component with the three channels of the image data. Ultimately, the resulting stitched image data has six channels.

[0158] The Image Trigger Generator is a specially designed deep learning model that uses image information and modality-invariant components in the stitched image data to generate image perturbations. During training, the Image Trigger Generator optimizes its parameters using a backpropagation algorithm to more accurately generate image perturbations. During inference, the Image Trigger Generator, which has already completed parameter optimization, generates perturbations on the stitched image data.

[0159] After obtaining the generated image perturbation, the image perturbation is added to the image data. "Adding" refers to superimposing the image perturbation with the original image data to generate the poisoned image data. This process can be accomplished using a simple image fusion algorithm, such as directly superimposing the pixel values of the two images and limiting the resulting pixel values to [0, 255]. The resulting poisoned image data will contain information about the original image data as well as the generated image perturbation (the backdoor trigger).

[0160] In another implementation, the training process of the image trigger generator specifically includes:

[0161] S44. Based on the similarity between the objects in the training image data in the preset training multimodal data and the text data in the training multimodal data, select some key objects in the training image data to generate an image modality invariant component.

[0162] The process of obtaining the image modality invariant component has been discussed in detail in steps S21 to S24 and will not be repeated here.

[0163] S45. Based on the training image data and the image modality invariant component, a predicted image perturbation is obtained through a generator in an initial generative adversarial model, and the predicted image perturbation is added to the training image data to obtain predicted poisoned image data.

[0164] Specifically, the initial generative adversarial model includes a generator, a discriminator, and an auxiliary image feature encoder. The task of the generator is to extract useful features from the training image data and the modality-invariant component, and on this basis, generate a predicted image perturbation located in the modality-invariant component area. The task of the discriminator is to determine whether the generated perturbation can be integrated with the training image data, so that the final poisoned image has good concealment. The image feature encoder can be aimed at extracting the semantic features of the reference poisoned image data, so that the generator can better implant the features of the poisoned data into the adversarial perturbation.

[0165] When designing a visual trigger generator, first provide a preset image patch trigger and paste it on the benign image x v To get a visible poisoning image For reference, this process can be expressed using the formula:

[0166]

[0167] Where m is a predefined mask and ⊙ represents the element-wise product. However, the reference image obtained in this way Not concealable.

[0168] Therefore, in order to generate invisible poisoned samples with good concealment, a novel generative model is designed in the specific implementation of this application. This model needs to meet two requirements:

[0169] 1. Predicting poisoned image data and the original training image data x v are visually indistinguishable;

[0170] 2. Predicting poisoned image data and visible poisoning image data have similar semantic features, thereby preserving the semantic features of the patch trigger p and allowing the victim model to establish a backdoor association between the trigger p and the attacker-specified label.

[0171] In the specific implementation of this application, the clean training image data x v The corresponding modal invariant region M(x v ) are concatenated along the channel dimension and fed into the generator. During training, the generator gradually learns how to generate perturbations that are well concealed when superimposed on the original image and that incorporate features from the reference poisoned image data into the perturbations.

[0172] The predicted image perturbations obtained by the generator are added to the clean training image data to form the predicted poisoned image data. The addition process can be completed by a simple image fusion algorithm.

[0173] S46. Generate a first discrimination probability corresponding to the training image data and a second discrimination probability corresponding to the predicted poisoned image data through the discriminator in the initial generative adversarial model.

[0174] Specifically, in the initial generative adversarial model, the discriminator is a pre-trained binary classification model used to determine whether the input image is a real image or a fake image generated by the generator. The discriminator's task is to distinguish between these two types of images as accurately as possible.

[0175] First, the training image data is input into the discriminator to obtain the first discriminant probability. This probability represents the degree of confidence of the discriminator that the training image data is considered to be a real image.

[0176] Next, the predicted poisoned image data is input into the discriminator to obtain a second discriminant probability, which represents the degree of confidence of the discriminator in regarding the predicted poisoned image data as a real image.

[0177] By comparing the first and second discriminant probabilities, the visual concealment of the predicted poisoned image data in pixel space is evaluated. If the two probabilities are similar, it indicates that the predicted poisoned image data is visually similar to the training image data and difficult for the discriminator to distinguish. This means that the predicted poisoned image data has good concealment. Conversely, a large difference between the two probabilities indicates that the predicted poisoned image data is significantly different from the training image data and has poor concealment.

[0178] S47: Add the preset image patch trigger to the training image data to obtain reference poisoned image data.

[0179] Specifically, by adding the preset image patch trigger described in step S45 to the training image data, reference poisoned image data can be obtained, and by comparing it with the predicted poisoned image data obtained in step S45 in the semantic feature space, the attack effectiveness of the backdoor attack can be evaluated and optimized.

[0180] S48. Determine an image loss function based on the predicted image disturbance, the predicted poisoned image data, the training image data, the reference poisoned image data, the first discriminant probability, and the second discriminant probability.

[0181] Specifically, the predicted poisoned image data is generated based on the predicted image perturbation and the training image data. The predicted image perturbation is obtained by the generator in the initial generative adversarial model, and the predicted image perturbation is added to the training image data to obtain the predicted poisoned image data.

[0182] In one implementation, the reference poisoned image data is used as a target, and the difference between the predicted poisoned image data and the reference poisoned image data is compared. The difference can be calculated using mean square error (MSE) or other suitable image similarity metrics, and the difference is used as part of the image loss function.

[0183] Next, the discriminator in the initial generative adversarial model generates a first discriminant probability for the training image data and a second discriminant probability for the predicted poisoned image data. The first and second discriminant probabilities represent the probability that the discriminator will identify the training image data and the predicted poisoned image data as real images, respectively. Based on the first and second discriminant probabilities, a discriminant loss is calculated, which measures the discriminant performance of the discriminator for the training image data and the predicted poisoned image data. This discriminant loss will serve as the other part of the image loss function.

[0184] The two losses are then added together, or weighted, to produce an image loss function. This image loss function can be used as an optimization objective to train and adjust the parameters of the generative adversarial model, enabling it to better generate covert poisoned image data, thereby improving the effectiveness and stealth of backdoor attacks.

[0185] In a specific implementation of the present application, determining the image loss function based on the predicted poisoned image data, the training image data, the reference poisoned image data, the first discriminant probability, and the second discriminant probability specifically includes:

[0186] S481, calculating a first loss function term based on the predicted poisoned image data and the training image data;

[0187] Specifically, in the specific implementation of this application, the first loss function term uses the L2 norm as the reconstruction loss The L2 norm (also known as the Euclidean norm) is a commonly used method to measure the difference between two vectors. It is used to measure the perceptual similarity between the predicted poisoned image data and the training image data. This metric can serve as a good invisibility constraint. Usually, when the L2 norm of two images is small, it indicates that the two images are visually similar.

[0188] Among them, the predicted poisoned image data and the training image data are regarded as two vectors, and the L2 norm of the two vectors is calculated. The value of this norm is the reconstruction loss

[0189] In summary, the first loss function term can be used to evaluate the perceptual similarity between the predicted poisoned image data and the training image data. When optimizing the generative adversarial model, this loss function term is combined with other loss function terms as the overall optimization goal.

[0190] During the training process, the parameters of the generated adversarial model are continuously updated to make the reconstruction loss The value of is minimized, which makes the predicted poisoned image data closer to the training image data, thereby improving the performance of the generative adversarial model.

[0191] S482. Calculate a second loss function term based on the first discriminant probability and the second discriminant probability;

[0192] The first discriminant probability and the second discriminant probability represent the probabilities that the training image data and the predicted poisoned image data are identified as real images by the discriminator, respectively. The adversarial loss term aims to minimize the domain difference between the predicted poisoned image data and the training image data. In the specific implementation of this application, the formula is used:

[0193]

[0194] in, is the discriminator, is the training image data, x v It is the predicted poisoned image data.

[0195] Under the adversarial loss constraint, the discriminator aims to find the difference between the predicted poisoned image data and the training image data, while the trigger generator attempts to generate real poisoned samples in a more covert way to further deceive the discriminator.

[0196] The adversarial loss term can be used as a second loss function term and used together with other loss function terms to train and adjust the generative adversarial model.

[0197] S483. Calculate a third loss function term based on the predicted image perturbation and the image modality invariant component;

[0198] Specifically, the trigger generator We attempt to inject backdoor triggers into the region of the image modality-invariant component to generate more generalizable covert poisoned samples, making the attack applicable to a variety of cross-modal learning applications. To achieve this goal, an additional constraint is proposed in the specific implementation of this application. to penalize perturbations outside the modal invariant region. This forces the generator Injecting poisonous information into modal-invariant components.

[0199] Among them, the third loss function term can be expressed as:

[0200] L reg =||G([x v ;M(x v )])⊙(1-M(x v ))||

[0201] Among them, G([x v ;M(x v )]) means to convert the clean image x v and its modally invariant component M(x v ) is concatenated as input, where ⊙ represents the element-by-element product and ||.|| represents the norm of the vector.

[0202] S484: extracting a first image feature of the predicted poisoned image data and a second image feature of the reference poisoned image data, and calculating a fourth loss function term based on the first image feature and the second image feature;

[0203] Specifically, extracting the first image feature of the predicted poisoning image data is accomplished by applying a pre-trained deep neural network model (e.g., a convolutional neural network) to the predicted poisoning image data. The predicted poisoning image data is input into the model, and the output of a certain layer is obtained as the first image feature.

[0204] Similarly, the second image feature of the reference poisoned image data is extracted by inputting the reference poisoned image data into the same deep neural network model and obtaining the output of the same layer as the second image feature.

[0205] To measure the similarity between the first image feature and the second image feature, cosine similarity is used in the specific implementation of this application. Cosine similarity is a commonly used method for measuring vector similarity. It measures the cosine value of the angle between two vectors. When two vectors are similar, the angle is small and the cosine value is close to 1; when two vectors are dissimilar, the angle is large and the cosine value is far from 1. By calculating the cosine similarity between the first image feature and the second image feature, the similarity between them can be obtained.

[0206] The fourth loss function term is calculated based on the obtained similarity by comparing the similarity value with the predetermined target similarity value and calculating the difference between them. This difference will be used as the fourth loss function term. fea It can be expressed as:

[0207]

[0208] The smaller the value of the fourth loss function term, the more similar the features of the predicted poisoned image data and the reference poisoned image data are, which means that the predicted poisoned image data contains the poisonous information added to the reference poisoned image data, that is, the preset image patch trigger.

[0209] S485. Calculate an image loss function based on the first loss function term, the second loss function term, the third loss function term, and the fourth loss function term.

[0210] Specifically, based on the first loss function term, the second loss function term, the third loss function term, and the fourth loss function term described in steps S481-S484, the image loss function is obtained by adding them according to certain weights. The image loss function is used as an optimization target to train and adjust the generative adversarial model. In the specific implementation of this application, the image loss function can be expressed as:

[0211]

[0212] Among them, α, β, and γ are preset weight parameters.

[0213] S49. Train the initial generative adversarial model based on the image loss function, and use the generator in the trained initial generative adversarial model as an image trigger generator.

[0214] It's worth noting that in this application's implementation, the auxiliary image feature extractor maintains frozen parameters during training, meaning its parameters aren't updated via the model's backpropagation mechanism. Parameter updates for the adversarial model are limited to the generator and discriminator. Furthermore, the generation of poisoned images is performed solely by the adversarial model's generator.

[0215] S50. Based on the text data and the text modality invariant component, generate poisoned text data through a text triggering generator corresponding to the text modality.

[0216] Specifically, the text modality invariant component is a keyword in the text and has important significance for the semantics and grammar of the text. The specific implementation of this application focuses on embedding invisible text triggers into the text data while retaining the original semantics and grammar.

[0217] Generating invisible text triggers is relatively difficult because text data is discrete and cannot be inserted by adding adversarial perturbations, as with the image triggers described in steps S44 to S49. Furthermore, to ensure that the poisoned text is grammatically fluent and semantically consistent with the original clean text, the specific implementation of this application employs a method for embedding backdoor triggers by performing synonym replacement using modality-invariant components in the text, namely keywords.

[0218] For example, suppose there is a text data with the content: "The quick brown fox jumps over the lazy dog." In this example, "quick", "brown", "fox", "jumps", "lazy", and "dog" can all be considered as keywords or modal invariant components of the text. A specific implementation of the application can select one or more of these keywords and replace them with synonyms.

[0219] For example, "quick" can be replaced with "swift," and "jumps" with "leaps." After these replacements, the text becomes: "The swift brown fox leaps over the lazy dog." Although the surface form of the text has changed, its underlying semantics and grammatical structure remain unchanged. In this way, backdoor triggers can be successfully implanted into text without arousing suspicion. In particular, the replacement synonyms must be carefully selected by an algorithm, rather than just any synonym. Designing an efficient algorithm to implant backdoor triggers through a synonym replacement strategy is the research focus of this application.

[0220] It's important to note that synonym replacement must consider not only semantic similarity but also word co-occurrence probability and contextual compatibility. When selecting synonyms for replacement, ensure that the new text is grammatically and semantically consistent with the original. Furthermore, to further enhance the stealthiness of the attack, select words that appear less frequently in the text but don't arouse suspicion. During the replacement process, existing word vector models and natural language processing tools are used to assist in the selection and replacement of synonyms.

[0221] In one implementation, generating poisoned text data based on the text data and the text modality invariant component by triggering a text generator corresponding to the text modality specifically includes:

[0222] S51. Replace the keywords in the text modality invariant component in the text data with preset text triggers to obtain reference poisoned text data.

[0223] In the specific implementation of this application, the preset text trigger is a rare word w p .

[0224] S52: Construct a synonym candidate set for each keyword in the text modality invariant component.

[0225] Specifically, to ensure that the replaced poisoned text is semantically similar to the clean text, a context-aware synonym candidate set needs to be constructed for each keyword. The specific implementation of this application utilizes a BERT-based masked language model to achieve this goal.

[0226] S53 , based on the similarity between the poisoned text data to be determined and the reference poisoned text data as the objective function, a target synonym group is selected from all synonym candidate sets.

[0227] Specifically, in order to make the invisible poisoned text as close as possible to the explicit poisoned samples in the latent feature space, the above objective is optimized by finding the optimal synonym combination in all candidate sets.

[0228] In the specific implementation of this application, the objective function for obtaining invisible poisoned text is:

[0229]

[0230] S54: Replace the keywords in the text data with each target synonym to form poisoned text data.

[0231] For example, for the text data "The quick brown fox jumps over the lazy dog.", the keywords may be "quick", "brown", "fox", "jumps", "lazy", and "dog". Assume that the preset text trigger is a rare word "quixotic". In step S51, a keyword, such as "quick", is selected and replaced with "quixotic" to obtain the reference poisoned text data "The quixotic brown fox jumps over the lazydog.". In step S52, a synonym candidate set is constructed for each keyword. For example, for the keyword "quick", the candidate set may include "fast", "swift", "speedy", etc. In step S53, the target synonym group is selected by optimizing the objective function. Assume that the target synonym is "swift". Finally, in step S54, the keyword "quick" is replaced with "swift" to obtain the poisoned text data "The swift brown fox jumps over the lazy dog.". The above process only replaces a single word. In order to achieve a better backdoor attack effect, it is generally necessary to replace multiple keywords.

[0232] In another implementation, the generation process of the text trigger generator specifically includes:

[0233] S55. Based on the similarity between the words in the text data in the training multimodal data and the training image data, select some key words in the training text data to generate a text modality invariant component.

[0234] Specifically, each word is compared with the training image data, and based on the similarity between the word and the training image data, the word with the higher similarity is selected as the text modality invariant component. In the specific implementation of this application, the text modality invariant component is the keyword in the text, which is of great significance to the semantics and grammar of the text.

[0235] S56: replacing keywords in the text modality invariant component in the text data with preset text triggers to obtain reference poisoned text data;

[0236] Specifically, a rare word is selected as the explicit text trigger pattern, and then all modality-invariant keywords in the text are replaced with this rare word to obtain explicit poisoning samples.

[0237] S57, determining a text loss item based on the reference poisoned text data, the training text data, and the predicted poisoned text data;

[0238] S58. Based on the text loss item, the text trigger generator seeks the optimal synonym combination to maximize the loss item, thereby obtaining the final predicted poisoned text data.

[0239] Specifically, to ensure concealment, the specific implementation of this application adopts a synonym replacement strategy to generate invisible poisoned text, whose semantics are similar to clean text. A context-aware synonym candidate set is constructed for each keyword using a BERT-based masked language model, and the target is optimized by finding the optimal synonym combination in all candidate sets.

[0240] Among them, finding the optimal invisible poison text is computationally complex, so a greedy algorithm is used to solve the loss function. The specific greedy algorithm pseudo code is as follows: Figure 3 shown.

[0241] S60: Generate poisoning multimodal data based on the poisoning image data and the poisoning text data.

[0242] Specifically, a small portion of clean image data and clean text data is selected, and malicious triggers are added to them using the image trigger generator and text trigger generator proposed in this application to obtain the corresponding poisoned image data and poisoned text data. After the victim entity collects these poisoned data posted on the Internet, it will be mixed with other clean data to obtain a multimodal dataset for use in multimodal reference training. Since the dataset contains poisoned image data and poisoned text data, the generated multimodal data is poisonous and can successfully implant a backdoor into the neural network during the training process. In this way, the malicious behavior injected in the training phase can be activated in the subsequent testing phase.

[0243] In summary, the present application provides a backdoor attack method for cross-modal learning, the method comprising obtaining text data and image data to be attacked; based on the similarity between objects in the image data and the text data, selecting some key objects to generate image modality invariant components; based on the similarity between words in the text data and the image data, selecting some key words to generate text modality invariant components; based on the image data and the image modality invariant components, generating poisoned image data through an image trigger generator corresponding to the image data; based on the text data and the text modality invariant components, generating poisoned text data through a text trigger generator corresponding to the text modality; based on the poisoned image data and the poisoned text data, generating poisoned multimodal data. The present application constructs a unified cross-modal backdoor attack framework that is flexible and can be applied to a variety of backdoor scenarios for cross-modal learning. In the process of implementing the backdoor attack, a cross-modal mining mechanism is used to identify high-quality modality invariant components as carriers of backdoor triggers; wherein, concealed poisoned image data is generated by utilizing the image modality invariant components and the image trigger generator, while imperceptible poisoned text data is generated by using the text modality invariant components and the text trigger. Furthermore, poisoned multimodal data is generated based on the poisoned image data and text data. To enhance the stealthiness of backdoor attacks, adversarial learning and synonym replacement strategies are employed to construct modality-specific generators, thereby achieving highly stealthy backdoor attacks. Through the aforementioned methods, this application improves the stealthiness and effectiveness of backdoor attacks targeting cross-modal learning.

[0244] Based on the above-mentioned backdoor attack method for cross-modal learning, this embodiment provides a backdoor attack device for cross-modal learning, the device comprising:

[0245] An acquisition module, configured to acquire multimodal data to be attacked, wherein the multimodal data includes text data and image data;

[0246] A first selection module is configured to select some key objects in the image data based on similarities between the objects in the image data and the text data to generate an image modality invariant component;

[0247] A second selection module is configured to select some key words from the text data to generate a text modality invariant component based on similarities between the words in the text data and the image data;

[0248] A first generating module is configured to generate poisoned image data based on the image data and the image modality invariant component by triggering a generator corresponding to the image data;

[0249] A second generating module is configured to generate poisoned text data based on the text data and the text modality invariant component by triggering a text generator corresponding to the text modality;

[0250] The third generating module is used to generate poisoned multimodal data based on the poisoned image data and the poisoned text data.

[0251] Based on the above-mentioned backdoor attack method for cross-modal learning, this embodiment provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps in the backdoor attack method for cross-modal learning as described in the above-mentioned embodiment.

[0252] Based on the above backdoor attack method for cross-modal learning, this application also provides a terminal device, such as Figure 4 As shown, it includes at least one processor 20; a display screen 21; and a memory 22. It may also include a communications interface 23 and a bus 24. The processor 20, display screen 21, memory 22, and communications interface 23 can communicate with each other via bus 24. The display screen 21 is configured to display a preset user guidance interface in the initial setup mode. The communications interface 23 can transmit information. The processor 20 can call the logic instructions in the memory 22 to execute the method in the above embodiment.

[0253] In addition, the logic instructions in the memory 22 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0254] The memory 22, as a computer-readable storage medium, can be configured to store software programs or computer-executable programs, such as program instructions or modules corresponding to the methods in the embodiments of the present disclosure. The processor 20 executes the software programs, instructions, or modules stored in the memory 22 to perform functional applications and data processing, thereby implementing the methods in the above embodiments.

[0255] The memory 22 may include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data created based on the use of the terminal device. In addition, the memory 22 may include high-speed random access memory and non-volatile memory. For example, various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, may also be transient storage media.

[0256] In addition, the specific process of loading and executing the multiple instructions in the storage medium and the processor in the terminal device has been described in detail in the above method and will not be described here one by one.

[0257] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A backdoor attack method for cross-modal learning, characterized in that: The method comprises: Acquire multimodal data to be attacked, wherein the multimodal data includes text data and image data; Based on the similarity between the objects in the image data and the text data, selecting some key objects in the image data to generate image modality invariant components; Based on the similarity between the words in the text data and the image data, selecting some key words in the text data to generate a text modality invariant component; Based on the image data and the image modality invariant component, generating poisoned image data by triggering a generator corresponding to the image data; Based on the text data and the text modality invariant component, generating poisoned text data by triggering a generator using text corresponding to the text modality; Poisoning multimodal data is generated based on the poisoning image data and the poisoning text data.

2. The backdoor attack method for cross-modal learning according to claim 1 is characterized in that: The step of selecting some key objects from the image data based on the similarity between the objects in the image data and the text data to generate an image modality invariant component specifically includes: extracting all objects in the image data; respectively masking object regions corresponding to the respective objects in the image data to obtain masked images corresponding to the respective objects; respectively obtaining a first similarity between each masked image and the text data; A preset number of key target objects are selected from all objects according to the first similarities, and the selected preset number of key target objects are used as image modality invariant components.

3. The backdoor attack method for cross-modal learning according to claim 1, characterized in that: The step of selecting some key words from the text data based on the similarity between the words in the text data and the image data to generate a text modality invariant component specifically includes: Shielding each word in the text data separately to obtain shielded text corresponding to each word; respectively calculating a second similarity between each shielded file and the image data; A preset number of keywords are selected from the text data according to each second similarity, and the selected preset number of keywords are used as text modality invariant components.

4. The backdoor attack method for cross-modal learning according to claim 1, characterized in that: The generating of the poisoned image data based on the image data and the image modality invariant component by triggering the generator corresponding to the image data specifically includes: splicing the image data and the image modality invariant component according to channels to obtain spliced image data; Inputting the stitched image data into an image trigger generator corresponding to the image data, and generating image perturbation through the image trigger generator; The image perturbation is added to the image data to obtain poisoned image data.

5. The backdoor attack method for cross-modal learning according to claim 1, characterized in that: The generating of poisoned text data by triggering a text generator corresponding to the text modality based on the text data and the text modality invariant component specifically includes: Replacing keywords in the text data belonging to the text modality invariant component with preset text triggers to obtain reference poisoned text data; Constructing a synonym candidate set for each keyword in the text modality invariant component; Based on the similarity between the poisoned text data to be determined and the reference poisoned text data as the objective function, an approximately optimal target synonym group is selected from all synonym candidate sets to maximize the objective function; Each target synonym replaces a keyword in the text data to form poisoned text data.

6. The backdoor attack method for cross-modal learning according to claim 1, characterized in that: The training process of the image trigger generator specifically includes: Based on the similarity between objects in training image data in the preset training multimodal data and text data in the training multimodal data, some key objects are selected in the training image data to generate image modality invariant components; Based on the training image data and the image modality invariant component, a predicted image perturbation is obtained by a generator in an initial generative adversarial model, and the predicted image perturbation is added to the training image data to obtain predicted poisoned image data; Generate a first discriminant probability corresponding to the training image data and a second discriminant probability corresponding to the predicted poisoned image data through the discriminator in the initial generative adversarial model; Adding a preset image patch trigger to the training image data to obtain reference poisoned image data; determining an image loss function based on the predicted image perturbation, the predicted poisoned image data, training image data, reference poisoned image data, a first discriminant probability, and a second discriminant probability; The initial generative adversarial model is trained based on the image loss function, and the generator in the trained initial generative adversarial model is used as an image trigger generator.

7. The backdoor attack method for cross-modal learning according to claim 6, characterized in that: The determining of the image loss function based on the predicted poisoned image data, the training image data, the reference poisoned image data, the first discrimination probability and the second discrimination probability specifically includes: Calculating a first loss function term based on the predicted poisoned image data and the training image data; Calculating a second loss function term based on the first discriminant probability and the second discriminant probability; Calculating a third loss function term based on the predicted image perturbation and the image modality invariant component; extracting a first image feature of the predicted poisoned image data and a second image feature of the reference poisoned image data, and calculating a fourth loss function term based on the first image feature and the second image feature; An image loss function is calculated based on the first loss function term, the second loss function term, the third loss function term, and the fourth loss function term.

8. A backdoor attack device for cross-modal learning, characterized in that: The device comprises: An acquisition module, configured to acquire multimodal data to be attacked, wherein the multimodal data includes text data and image data; A first selection module is configured to select some key objects in the image data based on similarities between the objects in the image data and the text data to generate an image modality invariant component; A second selection module is configured to select some key words from the text data to generate a text modality invariant component based on similarities between the words in the text data and the image data; A first generating module is configured to generate poisoned image data based on the image data and the image modality invariant component by triggering a generator corresponding to the image data; A second generating module is configured to generate poisoned text data based on the text data and the text modality invariant component by triggering a text generator corresponding to the text modality; The third generating module is used to generate poisoned multimodal data based on the poisoned image data and the poisoned text data.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the backdoor attack method for cross-modal learning as described in any one of claims 1-7.

10. A terminal device, characterized in that: include: processor and memory; The memory stores a computer-readable program executable by the processor; When the processor executes the computer-readable program, the processor implements the steps in the backdoor attack method for cross-modal learning as described in any one of claims 1 to 7.

Images