Neural network backdoor attack defense method and device for enhancing anti-cracking capability

Abstract

The application provides a neural network backdoor attack defense method and device for enhancing the anti-cracking capability, the method comprising: generating label feature groups according to the label types to which each image training data in an initial training set belongs; obtaining the correlation degree values between each feature vector in each label feature group and other feature vectors, and determining the image training data corresponding to an abnormal feature vector as backdoor data if it is determined that there is an abnormal feature vector based on the correlation degree values; and training a target neural network after filtering out the backdoor data from the initial training set to obtain a backdoor attack defense neural network for image recognition. The application can effectively reduce the defense calculation complexity while ensuring the accuracy of the neural network trained for image recognition, and can effectively enhance the defense capability of the neural network against backdoor attacks in high-intensity decision confrontation, thereby improving the application security of the neural network and the reliability of the image recognition result of the decision output.

Description

Technical Field

[0001] This application relates to the field of image recognition technology, and in particular to a method and apparatus for defending against neural network backdoor attacks to enhance anti-hacking capabilities. Background Technology

[0002] In image recognition fields such as facial recognition and telemetry image recognition, neural networks are commonly used to achieve automated and intelligent recognition. However, with the widespread application of artificial intelligence (AI) technology, its security issues are becoming increasingly prominent. Attacks against AI technology can lead to serious consequences such as incorrect output results or even system crashes. Neural network backdoor attacks, in particular, are highly dangerous and covert. They pose significant security risks to intelligent applications that use neural networks for image recognition, thus requiring effective methods to enhance the model's backdoor attack defense capabilities and prevent backdoor attacks from occurring.

[0003] Currently, one existing method for enhancing neural network backdoor attack defense capabilities is to adjust the decision boundary through adversarial training, maximizing the distance between different sample classes to weaken the backdoor effect in the model. However, during adversarial training, the model learns a large number of additional backdoor trigger features, which significantly impacts model performance and alters the model's decision boundary, negatively affecting its accuracy. A second existing method involves reverse engineering backdoor triggers to identify potential backdoor attack patterns, determine the neurons activated by these triggers, and then prune some neurons in the model to disable the backdoor triggers. However, this pruning method may inadvertently prune normal and important neurons in the model, significantly impacting the model's accuracy. A third existing method involves alternating between "backdoor sample filtering" and "model learning" during the backdoor sample self-filtering stage. Furthermore, the model needs to be updated every K training epochs during model learning, making the computation process cumbersome. Additionally, the accuracy of filtering backdoor samples in the early stages of the alternating calculation is low, failing to prevent backdoor samples from entering the model training set, thus affecting the method's accuracy.

[0004] In other words, regardless of which of the above-mentioned neural network backdoor attack defense methods are used to enhance anti-hacking capabilities, they all have the problem of not being able to simultaneously guarantee the accuracy of the trained neural network in image recognition and the neural network's ability to defend against backdoor attacks. Summary of the Invention

[0005] In view of this, embodiments of this application provide a neural network backdoor attack defense method and apparatus for enhancing anti-cracking capabilities, so as to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of this application provides a method for defending against neural network backdoor attacks to enhance anti-hacking capabilities, including:

[0007] Based on the label type of each image training data in the initial training set, a label feature group corresponding to each type of label is generated. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type.

[0008] Obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each feature vector, then the image training data corresponding to the abnormal feature vector is determined as backdoor data.

[0009] The backdoor data is filtered out from the initial training set to form a corresponding backdoor attack defense training set, and the target neural network is trained using the backdoor attack defense training set to obtain a backdoor attack defense neural network for image recognition.

[0010] In some embodiments of this application, obtaining the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group includes:

[0011] Obtain the dissimilarity matrix between each feature vector in each of the label feature groups;

[0012] Based on each of the dissimilarity matrices, the correlation probability matrix between each feature vector in each of the label feature groups is determined;

[0013] Based on each of the association probability matrices, the association degree value between each feature vector in each of the label feature groups and other feature vectors in the same group is determined.

[0014] In some embodiments of this application, before determining the correlation degree value between each feature vector in each of the label feature groups and other feature vectors in the same group based on each of the correlation probability matrices, the method further includes:

[0015] The correlation probability matrix is ​​corrected based on a preset smoothing metric.

[0016] In some embodiments of this application, the step of determining the image training data corresponding to the abnormal feature vector as backdoor data if an abnormal feature vector is determined to exist among the feature vectors based on the correlation value corresponding to each of the feature vectors includes:

[0017] Determine whether the correlation value corresponding to each feature vector in each of the label feature groups is less than the threshold corresponding to each of the label feature groups, wherein the threshold is preset based on the Bayesian risk standard;

[0018] If there is a feature vector that is less than the threshold corresponding to the label feature group in which it belongs, then the feature vector is determined to be an abnormal feature vector.

[0019] The image training data corresponding to the abnormal feature vector is identified as backdoor data.

[0020] In some embodiments of this application, before generating the label feature groups corresponding to each type of label based on the label type to which each image training data belongs in the initial training set, the method further includes:

[0021] Each image training data in the initial training set is sequentially input into a pre-trained convolutional neural network, so that the convolutional neural network outputs the feature vector corresponding to each image training data.

[0022] In some embodiments of this application, before sequentially inputting the training data of each image in the initial training set into the pre-trained convolutional neural network, the method further includes:

[0023] Acquire multiple historical image data and the corresponding labels for each of the historical image data;

[0024] Each of the historical image data is preprocessed to obtain image training data corresponding to each of the historical image data, and an initial training set containing each of the image training data is generated.

[0025] In some embodiments of this application, the step of preprocessing the historical image data to obtain image training data corresponding to each historical image data includes:

[0026] Super-resolution processing is performed on each of the historical image data to obtain corresponding high-frequency historical image data and low-frequency historical image data, and edge information of the high-frequency historical image data is extracted.

[0027] The low-frequency historical image data is interpolated using bicubic interpolation, and the high-frequency historical image data is interpolated using bilinear interpolation based on the high-frequency historical image data and the edge information. Both the interpolated low-frequency and high-frequency historical image data are then used as image training data.

[0028] Another aspect of this application provides a neural network backdoor attack defense device for enhancing anti-hacking capabilities, comprising:

[0029] The label feature grouping module is used to generate label feature groups corresponding to each type of label based on the label type to which each image training data belongs in the initial training set. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type.

[0030] The backdoor data search module is used to obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each of the feature vectors, then the image training data corresponding to the abnormal feature vector is determined as backdoor data.

[0031] The backdoor filtering and model training module is used to filter out the backdoor data from the initial training set to form a corresponding backdoor attack defense training set, and to use the backdoor attack defense training set to train the target neural network to obtain a backdoor attack defense neural network for image recognition.

[0032] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the neural network backdoor attack defense method for enhancing anti-hacking capabilities.

[0033] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the described neural network backdoor attack defense method for enhancing anti-hacking capabilities.

[0034] The neural network backdoor attack defense method provided in this application enhances anti-cracking capabilities by generating label feature groups corresponding to various labels based on the label types of each image training data in the initial training set. Each label feature group stores the feature vectors corresponding to each image training data belonging to its unique label type. The method obtains the correlation values ​​between each feature vector in each label feature group and other feature vectors in the same group. If an abnormal feature vector is determined based on the correlation values, the image training data corresponding to the abnormal feature vector is identified as backdoor data. The backdoor data is filtered out from the initial training set to form a corresponding backdoor attack defense training set. This training set is then used to train a target neural network to obtain a backdoor attack defense neural network for image recognition. This method effectively reduces the computational complexity of defense while ensuring the accuracy of image recognition by the trained neural network. It also effectively enhances the neural network's defense capability against backdoor attacks in high-intensity decision-making confrontation, thereby improving the application security of the neural network and the reliability of its decision-output image recognition results.

[0035] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0036] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0037] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0038] Figure 1 This is a schematic diagram of the first process of a neural network backdoor attack defense method for enhancing anti-cracking capabilities according to an embodiment of this application.

[0039] Figure 2This is a schematic diagram of a second process of a neural network backdoor attack defense method for enhancing anti-cracking capabilities according to an embodiment of this application.

[0040] Figure 3 This is a schematic diagram of the third process of a neural network backdoor attack defense method for enhancing anti-cracking capabilities in one embodiment of this application.

[0041] Figure 4 This is a schematic diagram of a neural network backdoor attack defense device for enhancing anti-hacking capabilities according to another embodiment of this application.

[0042] Figure 5 This is a schematic diagram illustrating the execution process of a neural network backdoor attack defense method for enhancing anti-cracking capabilities, as shown in an application example of this application.

[0043] Figure 6 This is a schematic diagram of the functional architecture of a neural network backdoor attack defense device used to enhance anti-cracking capabilities in an application example of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0045] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the scheme according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0046] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0047] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0048] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0049] Neural network backdoor attacks implant backdoors into the model, misleading it into classifying backdoor instances as target labels specified by the attacker. When a backdoored model is applied in command and decision-making intelligence applications such as situational awareness, task analysis, and action plan generation, it will output incorrect strategies when it detects trigger flags, leading to the failure of adversarial tasks and incalculable losses. Given the significant security risks posed by the stealth and harmfulness of backdoor attacks to intelligent applications, effective methods are needed to enhance the model's backdoor attack defense capabilities and prevent backdoor attacks from occurring.

[0050] To enhance the model's backdoor attack defense capabilities, a feature space distance-based hardening strategy can be considered first. This strategy defines the distance between different sample classes as the basis for training. Label pairs are dynamically scheduled using general backdoor pre-selection and post-training selection information. Symmetrical hardening training is then performed based on the scheduler's selection results until each class pair reaches its maximum class distance, thus achieving backdoor defense hardening training. However, this method uses adversarial training to adjust the decision boundary and maximize the distance between different sample classes to reduce the backdoor effect in the model. During adversarial training, the model learns a large number of additional backdoor trigger features, significantly impacting model performance and altering the model's decision boundary, negatively affecting model accuracy.

[0051] Another approach is to use reverse engineering to identify backdoor triggers present in the target deep neural network. Malicious data containing these backdoor triggers is then input into the target deep neural network, and neurons with high activation values ​​and high weights are identified as potentially compromised neurons. Based on the results, the deep neural network with the injected backdoor is then pruned. However, because this method reverse-engineers the backdoor triggers to find the trigger patterns that attackers might use to launch backdoor attacks, determines the neurons activated by these triggers, and then prunes some neurons in the model to disable the backdoor triggers, this pruning method may inadvertently prune normal and important neurons in the model, significantly impacting the accuracy of the model's results.

[0052] Alternatively, pre-trained models can be used to extract sample features, and the K-nearest neighbor algorithm can be used to detect backdoor target class samples. A partial classification model can be learned from non-target class samples. Then, alternating calculations of "backdoor sample filtering" and "model learning" are performed multiple times on this classification model to ultimately achieve model training and backdoor sample filtering. However, during model learning, the model needs to be updated every K training rounds, which is computationally cumbersome. Furthermore, during the alternating calculation process, the accuracy of filtering backdoor samples in the early stages is low, making it impossible to prevent backdoor samples from entering the model training set, thus affecting the accuracy of this method.

[0053] Therefore, this application studies the feature representation vector characteristics of benign samples and samples with backdoors on neural networks. By designing a neural network backdoor attack defense method to enhance anti-cracking capabilities, it performs enhancement, mapping transformation, and other computational operations to identify the differences in the correlation between the features of benign samples and samples with backdoors. This difference is used to filter backdoor sample data, solving the problem of backdoors being implanted in the neural network model during training. The filtered benign samples are then used to train the complete target model. Compared to the methods described above, this application has advantages in backdoor sample filtering and benign model training, effectively enhancing the defense capabilities of artificial neural networks against backdoor attacks and resisting such attacks.

[0054] The following examples will provide a detailed description.

[0055] Based on this, embodiments of this application provide a method for enhancing the defense against neural network backdoor attacks, which can be implemented by a neural network backdoor attack defense device for enhancing anti-hacking capabilities. See [link to relevant documentation]. Figure 1 The neural network backdoor attack defense method for enhancing anti-cracking capabilities specifically includes the following:

[0056] Step 100: Generate label feature groups corresponding to each type of label according to the label type of each image training data in the initial training set. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type.

[0057] In one or more embodiments of this application, the label type can be varied, depending on the actual application scenario. For example, if the current application scenario is a gender recognition scenario, the label type may include at least a first label for indicating "male" and a second label for indicating "female", etc. The first label and the second label can be specifically displayed numerically, such as "1" and "0", etc.

[0058] The initial training set mentioned in step 100 can directly use historical image data with various labels as image training data. However, to further improve the reliability and effectiveness of the neural network backdoor attack defense process used to enhance anti-hacking capabilities, the historical image data with various labels can be preprocessed before being used as image training data. This will be explained in detail in subsequent embodiments.

[0059] In step 100, the feature vectors corresponding to each pre-stored image training data can be directly used to further improve the execution efficiency and reduce the computational complexity of the neural network backdoor attack defense process used to enhance anti-hacking capabilities. To further ensure the effectiveness of the neural network backdoor attack defense process used to enhance anti-hacking capabilities, the feature vectors corresponding to each image training data can be extracted before executing step 100, as will be explained in detail in subsequent embodiments.

[0060] Step 200: Obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each feature vector, then the image training data corresponding to the abnormal feature vector is determined as backdoor data.

[0061] In step 200, if the execution basis for determining whether there are abnormal feature vectors in each feature vector is based on the correlation value corresponding to each of the feature vectors, it is obvious that the determination of whether there are abnormal feature vectors in each feature vector is first based on the correlation value corresponding to each of the feature vectors. This determination process can be performed by the neural network backdoor attack defense device for enhancing anti-cracking capabilities after obtaining the correlation value between each feature vector in each of the tag feature groups and other feature vectors in the same group. Alternatively, the neural network backdoor attack defense device for enhancing anti-cracking capabilities can send the obtained correlation value corresponding to each of the feature vectors to other devices so that other devices can perform the determination process and send the determination result back to the neural network backdoor attack defense device for enhancing anti-cracking capabilities. This can further reduce the resource consumption of the server when the neural network backdoor attack defense device for enhancing anti-cracking capabilities performs the neural network backdoor attack defense process for enhancing anti-cracking capabilities.

[0062] Step 300: Filter out the backdoor data from the initial training set to form a corresponding backdoor attack defense training set, and use the backdoor attack defense training set to train the target neural network to obtain a backdoor attack defense neural network for image recognition.

[0063] In one or more embodiments of this application, a backdoor attack defense neural network refers to a neural network with stronger anti-hacking capabilities compared to existing neural networks used for image recognition.

[0064] In step 300, the backdoor attack defense neural network used for image recognition can be a neural network model that can be used for image recognition, such as a convolutional neural network, a backpropagation neural network, or a feedforward neural network.

[0065] It should be noted that, in one or more embodiments of this application, the image recognition specifically refers to face image recognition, remote sensing image recognition, biological image clustering, scene image classification recognition, etc., and can be applied to face recognition scenarios, telemetry scenarios, and various image classification scenarios in access control monitoring. By adopting the neural network backdoor attack defense method for enhancing anti-hacking capabilities provided in this application, the accuracy and security of face image recognition, remote sensing image recognition, biological image clustering, and scene image classification recognition can be effectively improved. Specifically, security refers to the fact that the neural network backdoor attack defense method for enhancing anti-hacking capabilities provided in the embodiments of this application can effectively filter out backdoor data in the training data before training the neural network. This effectively enhances the defense capability against backdoor attacks when using the trained neural network for face image recognition, remote sensing image recognition, biological image clustering, scene image classification recognition, etc., and can effectively avoid significant security risks to intelligent applications using neural networks for face image recognition, remote sensing image recognition, biological image clustering, and scene image classification recognition.

[0066] As can be seen from the above description, the neural network backdoor attack defense method for enhancing anti-cracking capabilities provided in this application embodiment can effectively reduce computational complexity while ensuring the accuracy of image recognition performed by the trained neural network. It can also effectively enhance the neural network's defense capability against backdoor attacks in high-intensity decision-making confrontation, thereby improving the application security of the neural network and the reliability of its decision output image recognition results.

[0067] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 2 Step 200 of the neural network backdoor attack defense method for enhancing anti-hacking capabilities specifically includes the following:

[0068] Step 210: Obtain the dissimilarity matrix between each feature vector in each of the label feature groups.

[0069] Specifically, for each type of label sample set X (i.e., label feature grouping), the dissimilarity matrix d between feature vectors can be calculated using the following formula:

[0070]

[0071] Where, x i Let y be the i-th dimension feature vector of sample x in a group of label features of a class of labels; i For x iThe i-th feature vector of another sample y in the same label feature group; m is the feature vector dimension; D() is the normalization function; s is the normalization coefficient.

[0072] The dissimilarity matrix of the sample set X is calculated by formula, which is used to measure the differences between each feature vector in the sample set X. The correlation between each feature vector can be obtained by calculating and transforming the dissimilarity matrix of the samples.

[0073] Step 220: Determine the correlation probability matrix between each feature vector in each of the label feature groups based on each of the dissimilarity matrices.

[0074] Step 230: Based on each of the association probability matrices, determine the association degree value between each feature vector in each of the label feature groups and other feature vectors in the same group.

[0075] Specifically, the probability matrix ρ of sample association in each label category is calculated using the dissimilarity matrix of the sample set. i The correlation probability matrix ρ of the samples i The formula used to reflect the similarity of features among samples with the same label is:

[0076]

[0077] in, Indicates the degree of heterogeneity; represents the variance of the eigenvector of the i-th sample; exp() represents exponential calculation.

[0078] The correlation degree between a feature vector and other feature vectors in its label feature group can be calculated from the sample correlation probability matrix.

[0079] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 3 The method for defending against neural network backdoor attacks to enhance anti-hacking capabilities also includes the following specific content between steps 220 and 230:

[0080] Step 221: Correct the correlation probability matrix based on a preset smoothing metric.

[0081] Specifically, during implementation, it may happen that two samples with different but similar features to other samples may have a high correlation score. This is because the two samples have very similar features. To resolve this, the correlation probability matrix needs to be corrected by setting an appropriate smoothing metric to correct outliers in the correlation probability matrix. The calculation formula used in the correction process is as follows:

[0082]

[0083] Where h(ρ) i ) represents the correction function; ρ ij This represents the correlation value.

[0084] By employing subsequent correction strategies during the calculation of sample association degree, we can avoid calculating incorrect sample association degree results due to abnormal association probability values ​​of small clusters. This allows our method to accurately calculate the association degree of sample features for samples with different similar characteristics.

[0085] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 2 or Figure 3 Step 200 of the neural network backdoor attack defense method for enhancing anti-hacking capabilities further includes the following content executed after step 230:

[0086] Step 240: Determine whether the correlation value corresponding to each feature vector in each of the label feature groups is less than the threshold corresponding to each of the label feature groups, wherein the threshold is preset based on the Bayesian risk standard; if yes, proceed to step 250; if no, it means that there is no subsequent data in the current initial training set, and the target neural network can be directly trained using the initial training set.

[0087] Step 250: If there is a feature vector that is less than the threshold corresponding to the label feature group it belongs to, then the feature vector is determined to be an abnormal feature vector.

[0088] Step 260: Determine the image training data corresponding to the abnormal feature vector as backdoor data.

[0089] Specifically, when the correlation between samples is low, the sample's features differ greatly from other samples within the same label, indicating that the sample has a backdoor. When the correlation between samples is high, it means that the sample's features are highly similar to the features of other samples within the same label, making it a benign sample, and it is added to the training set for subsequent model training. The correlation value p(x) of the samples. i The formula for calculating ) is:

[0090] p(x i )=1-∏(1-ρ ij )

[0091] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 2 or Figure 3 The neural network backdoor attack defense method for enhancing anti-hacking capabilities also includes the following content before step 100:

[0092] Step 010: Input the training data of each image in the initial training set into the pre-trained convolutional neural network in sequence, so that the convolutional neural network outputs the feature vector corresponding to each of the training data of the image.

[0093] Specifically, convolutional neural network (CNN) models are used for sample feature extraction. A CNN is a neural network structure that uses multi-kernel convolution operations to achieve feature extraction. For an input sample I, there is a corresponding two-dimensional convolution kernel K. The formula for the feature extraction convolution operation is:

[0094] S(i,j)=(I*K)(i,j)=∑ m ∑ n I(i+m,j+n)K(m,n)

[0095] Where S(i,j) represents the convolution operation; j represents the coordinate point of the input sample; n represents the coordinate point on the convolution kernel; K() represents the convolution kernel; and I() represents the input sample.

[0096] Convolutional neural networks can extract features at various levels. The more layers a network has, the richer the features it can extract at different levels. Through the feature extraction process at multiple levels, features are gradually extracted from low-level features to high-level abstract features, thereby achieving the purpose of sample feature extraction.

[0097] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 2 The neural network backdoor attack defense method for enhancing anti-hacking capabilities also includes the following content before step 010:

[0098] Step 020: Obtain multiple historical image data and the corresponding tags for each of the historical image data.

[0099] Step 030: Perform data preprocessing on each of the historical image data to obtain image training data corresponding to each of the historical image data, and generate an initial training set containing each of the image training data.

[0100] To further improve the effectiveness and reliability of neural network backdoor attack defense methods for enhancing anti-hacking capabilities, this application provides a method for enhancing anti-hacking capabilities using neural network backdoor attacks, see [link to relevant documentation]. Figure 3 Step 030 of the neural network backdoor attack defense method for enhancing anti-hacking capabilities further includes the following:

[0101] Step 031: Perform super-resolution processing on each of the historical image data to obtain the corresponding high-frequency historical image data and low-frequency historical image data, and extract the edge information of the high-frequency historical image data.

[0102] Step 032: The low-frequency historical image data is interpolated using bicubic interpolation, and the high-frequency historical image data is interpolated using bilinear interpolation based on the high-frequency historical image data and the edge information. Both the interpolated low-frequency historical image data and the high-frequency historical image data are then used as image training data.

[0103] Specifically, super-resolution processing is performed on the data to reduce the impact of unclear data features on subsequent processing. The super-resolution processing transformation calculation formula is as follows:

[0104]

[0105] Where α is the scaling factor, τ is the shift factor, and f(t)∈L 2 (R), L 2 (R) represents a finite energy signal space, and the kernel function ψ(t) satisfies W ψ f represents the wavelet function; f represents the continuous wavelet transform; f(t) represents the time-domain data to be processed. t represents the basic wavelet; t represents the time frequency.

[0106] Through transform decomposition, the image is divided into low-frequency and high-frequency components, and edge information is extracted at the same time.

[0107] To achieve the desired results during implementation, different interpolation methods need to be used for low-frequency and high-frequency components. For low-frequency components, bicubic interpolation can be used directly; however, high-frequency components exhibit unclear contours, so for the high-frequency portion, edge information needs to be combined to obtain new high-frequency information. Bilinear interpolation is then applied to this new high-frequency information to effectively preserve edge details. A high-quality super-resolution image is obtained through inverse transformation.

[0108] The Bayesian risk framework is used to set a threshold. After the threshold is determined, the correlation value of the input data is analyzed and compared with the set threshold. The calculation results of the output data are then processed. Data that is judged to be a backdoor is filtered out, and data that is judged to be benign is input into the target model for model training.

[0109] From a software perspective, this application also provides a neural network backdoor attack defense device for enhancing anti-cracking capabilities, used to execute all or part of the aforementioned neural network backdoor attack defense method for enhancing anti-cracking capabilities. See [link to relevant documentation]. Figure 4 The neural network backdoor attack defense device for enhancing anti-hacking capabilities specifically includes the following components:

[0110] The label feature grouping module 10 is used to generate label feature groups corresponding to each type of label according to the label type to which each image training data belongs in the initial training set. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type.

[0111] The backdoor data search module 20 is used to obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each of the feature vectors, then the image training data corresponding to the abnormal feature vector is determined as backdoor data.

[0112] The backdoor filtering and model training module 30 is used to filter out the backdoor data from the initial training set to form a corresponding backdoor attack defense training set, and to use the backdoor attack defense training set to train the target neural network to obtain a backdoor attack defense neural network for image recognition.

[0113] The embodiments of the neural network backdoor attack defense device for enhancing anti-cracking capabilities provided in this application can be used to execute the processing flow of the embodiments of the neural network backdoor attack defense method for enhancing anti-cracking capabilities described above. Its functions will not be repeated here, but can be referred to the detailed description of the embodiments of the neural network backdoor attack defense method for enhancing anti-cracking capabilities described above.

[0114] The neural network backdoor attack defense device for enhancing anti-hacking capabilities described herein can perform the anti-hacking portion of the neural network backdoor attack defense either on a server or on a client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are performed on the client device, the client device may further include a processor for implementing the specific processing for enhancing anti-hacking capabilities of the neural network backdoor attack defense.

[0115] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0116] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0117] As can be seen from the above description, the neural network backdoor attack defense device for enhancing anti-cracking capabilities provided in this application embodiment can effectively reduce computational complexity while ensuring the accuracy of image recognition performed by the trained neural network. It can also effectively enhance the neural network's defense capability against backdoor attacks in high-intensity decision-making confrontation, thereby improving the application security of the neural network and the reliability of its decision output image recognition results.

[0118] To further illustrate this solution, this application also provides a neural network backdoor attack defense method that enhances anti-cracking capabilities, implemented using a neural network backdoor attack defense system for enhancing anti-cracking capabilities. This method enables backdoor data filtering and benign model training. (See [link to relevant documentation]). Figure 5 The application examples of the neural network backdoor attack defense method for enhancing anti-cracking capabilities specifically include the following:

[0119] Step 1: Data preprocessing. Super-resolution processing is performed on the data to reduce the impact on subsequent processing caused by unclear data features.

[0120] Through transform decomposition, the image is divided into low-frequency and high-frequency components, and edge information is extracted at the same time.

[0121] To achieve the desired results during implementation, different interpolation methods need to be used for low-frequency and high-frequency components. For low-frequency components, bicubic interpolation can be used directly; however, high-frequency components exhibit unclear contours, so for the high-frequency portion, edge information needs to be combined to obtain new high-frequency information. Bilinear interpolation is then applied to this new high-frequency information to effectively preserve edge details. A high-quality super-resolution image is obtained through inverse transformation.

[0122] Step 2: After data preprocessing, feature extraction is performed. The sample data is input into the pre-trained model, and the output of the second-to-last layer of the model is extracted as the sample features. This yields the feature representation vector of the sample data on the model network. Based on the sample labels, the features of samples with the same label are grouped together for subsequent calculation of the correlation between samples.

[0123] Step 3: Calculate the correlation degree for the feature vector of each type of labeled sample, compare the calculation results to separate the backdoor samples from the benign samples, thereby filtering out backdoor samples.

[0124] By employing subsequent correction strategies during the calculation of sample association degree, we can avoid calculating incorrect sample association degree results due to abnormal association probability values ​​of small clusters. This allows our method to accurately calculate the association degree of sample features for samples with different similar characteristics.

[0125] Step 4: Filter backdoor samples and train the target model. When the correlation of a sample is less than δ, it indicates that the sample is a backdoor sample. Remove the backdoor sample data from the dataset and use the filtered benign samples to train the target model, thereby obtaining a complete benign model without backdoors.

[0126] When classifying sample data, the threshold δ is set using the Bayesian risk framework B(d)=∫R(δ,d)π(δ)dδ to minimize the average expected loss of the threshold setting, where B(d) represents Bayesian risk; d represents the decision function; and R() is the risk function.

[0127] Based on this, see Figure 6 The neural network backdoor attack defense system used in this application example to implement the neural network backdoor attack defense method for enhancing anti-cracking capabilities includes the following:

[0128] The data preprocessing module performs super-resolution processing on the raw data. The module transforms and performs calculations on the raw data to output a high-quality super-resolution image.

[0129] The feature extraction module extracts features from the input data, extracts feature representation vectors on the neural network, categorizes the data, and outputs the categorized feature vectors.

[0130] The feature analysis module calculates the corresponding dissimilarity matrix, correlation probability matrix, and correlation degree of the extracted feature vectors, detects and corrects abnormal data in the correlation probability matrix, and outputs the correlation degree corresponding to the feature vectors.

[0131] First, consider the feature vector of the data x = [x1, ..., x...]. n The dissimilarity matrix between eigenvectors is calculated using the following formula:

[0132]

[0133] Then, the correlation probability matrix is ​​calculated for the dissimilarity matrix of the data. The correlation probability matrix reflects the similarity of features among samples of the same category. The calculation formula is as follows:

[0134]

[0135] The correlation degree between a sample and other samples can be calculated from the correlation probability matrix. The formula for calculating the correlation degree is:

[0136] p(x i )=1-∏(1-ρ ij )

[0137] The data analysis and processing module uses a Bayesian risk framework to set thresholds. After determining the thresholds, it analyzes the correlation values ​​of the input data, compares them with the set thresholds, outputs the calculated data, filters data identified as backdoors, and inputs data identified as benign into the target model for model training.

[0138] In summary, the neural network backdoor attack defense method and system for enhancing anti-cracking capabilities provided in this application example study the feature representation vector characteristics of benign samples and samples with backdoors on the neural network. Through enhancement, mapping, and other computational operations, the differences in the correlation between the features of benign samples and samples with backdoors are identified. These differences are then used to filter backdoor sample data, addressing the problem of backdoors being implanted in the neural network model during training. The filtered benign samples are then used to train a complete target model. This application has advantages in backdoor sample filtering and benign model training, effectively enhancing the defense capabilities of artificial neural networks against backdoor attacks and resisting such attacks.

[0139] In other words, the application examples of this application can achieve the filtering of backdoor data and the training of benign models, preventing backdoor sample data from entering model training and pruning the model, thus affecting its accuracy.

[0140] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the neural network backdoor attack defense method for enhancing anti-hacking capabilities mentioned in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0141] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0142] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the neural network backdoor attack defense method for enhancing anti-cracking capabilities in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the neural network backdoor attack defense method for enhancing anti-cracking capabilities in the above method embodiments.

[0143] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0144] The one or more modules are stored in the memory, and when executed by the processor, they execute the neural network backdoor attack defense method for enhancing anti-cracking capabilities in the embodiment.

[0145] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0146] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0147] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0148] This application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the aforementioned neural network backdoor attack defense method for enhancing anti-cracking capabilities. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0149] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0150] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0151] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0152] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for defending against neural network backdoor attacks to enhance anti-hacking capabilities, characterized in that, include: Acquire multiple historical image data and the corresponding tags for each of the historical image data; Based on the super-resolution transformation calculation formula, super-resolution processing is performed on each of the historical image data to obtain corresponding high-frequency historical image data and low-frequency historical image data, and the edge information of the high-frequency historical image data is extracted; the super-resolution transformation calculation formula is as follows: ( )( )= in, Represents the wavelet function; Represents continuous wavelet transform; As a scale factor, It is a movement factor. , This refers to the historical image data; The energy-limited signal space; Indicates the basic wavelet; Indicates time frequency; The low-frequency historical image data is interpolated using bicubic interpolation, and the high-frequency historical image data is interpolated using bilinear interpolation based on the high-frequency historical image data and the edge information. Both the interpolated low-frequency historical image data and the high-frequency historical image data are determined as image training data, and an initial training set containing each of the image training data is generated. Each image training data in the initial training set is sequentially input into a pre-trained convolutional neural network so that the convolutional neural network outputs the feature vector corresponding to each image training data. Based on the label type of each image training data in the initial training set, a label feature group corresponding to each type of label is generated. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type. Obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each feature vector, then the image training data corresponding to the abnormal feature vector is determined as backdoor data. The backdoor data is filtered out from the initial training set to form a corresponding backdoor attack defense training set, and the target neural network is trained using the backdoor attack defense training set to obtain a backdoor attack defense neural network for image recognition.

2. The neural network backdoor attack defense method for enhancing anti-cracking capabilities according to claim 1, characterized in that, The step of obtaining the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group includes: Obtain the dissimilarity matrix between each feature vector in each of the label feature groups; Based on each of the dissimilarity matrices, the correlation probability matrix between each feature vector in each of the label feature groups is determined respectively; Based on each of the aforementioned correlation probability matrices, the correlation degree value between each feature vector in each of the aforementioned label feature groups and other feature vectors in the same group is determined.

3. The neural network backdoor attack defense method for enhancing anti-cracking capabilities according to claim 2, characterized in that, Before determining the correlation degree value between each feature vector in each label feature group and other feature vectors in the same group based on each of the correlation probability matrices, the method further includes: The correlation probability matrix is ​​corrected based on a preset smoothing metric.

4. The neural network backdoor attack defense method for enhancing anti-cracking capabilities according to claim 1, characterized in that, If, based on the correlation value corresponding to each of the feature vectors, it is determined that there is an abnormal feature vector among the feature vectors, then the image training data corresponding to the abnormal feature vector is determined as backdoor data, including: Determine whether the correlation value corresponding to each feature vector in each of the label feature groups is less than the threshold corresponding to each of the label feature groups, wherein the threshold is preset based on the Bayesian risk standard; If there is a feature vector that is less than the threshold corresponding to the label feature group it belongs to, then the feature vector is determined to be an abnormal feature vector. The image training data corresponding to the abnormal feature vector is identified as backdoor data.

5. A neural network backdoor attack defense device for enhancing anti-hacking capabilities, characterized in that, The device is used to perform the following: Acquire multiple historical image data and the corresponding labels for each of the historical image data; Based on the super-resolution transformation calculation formula, super-resolution processing is performed on each of the historical image data to obtain corresponding high-frequency historical image data and low-frequency historical image data, and the edge information of the high-frequency historical image data is extracted; the super-resolution transformation calculation formula is as follows: ( )( )= in, Represents the wavelet function; Represents continuous wavelet transform; As a scale factor, It is a movement factor. , This refers to the historical image data; The energy-limited signal space; Indicates the basic wavelet; Indicates time frequency; The low-frequency historical image data is interpolated using bicubic interpolation, and the high-frequency historical image data is interpolated using bilinear interpolation based on the high-frequency historical image data and the edge information. Both the interpolated low-frequency historical image data and the high-frequency historical image data are determined as image training data, and an initial training set containing each of the image training data is generated. Each image training data in the initial training set is sequentially input into a pre-trained convolutional neural network so that the convolutional neural network outputs the feature vector corresponding to each image training data. The device further includes: The label feature grouping module is used to generate label feature groups corresponding to each type of label based on the label type to which each image training data belongs in the initial training set. Each label feature group is used to store the feature vector corresponding to each image training data belonging to its unique label type. The backdoor data search module is used to obtain the correlation value between each feature vector in each of the label feature groups and other feature vectors in the same group. If it is determined that there is an abnormal feature vector in each feature vector based on the correlation value corresponding to each of the feature vectors, then the image training data corresponding to the abnormal feature vector is determined as backdoor data. The backdoor filtering and model training module is used to filter out the backdoor data from the initial training set to form a corresponding backdoor attack defense training set, and to use the backdoor attack defense training set to train the target neural network to obtain a backdoor attack defense neural network for image recognition.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the neural network backdoor attack defense method for enhancing anti-cracking capabilities as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the neural network backdoor attack defense method for enhancing anti-cracking capabilities as described in any one of claims 1 to 4.

Images