Pre-trained language model backdoor detection method, device and electronic device

Abstract

The present specification discloses a method, device and electronic device for detecting backdoors in a pre-trained language model, wherein the method comprises: performing model twin processing on a target pre-trained language model to obtain a target model and an auxiliary model; inputting a backdoor test text into the target model and inserting trainable features into the target model to determine the target output features output by the target model for the backdoor test text; and determining the auxiliary output features output by the auxiliary model for the backdoor test text; performing model test training on the target model based on the target output features and the auxiliary output features to obtain a model test training result, and determining the backdoor detection information of the target pre-trained language model based on the model test training result.

Description

Technical Field

[0001] This specification relates to the field of natural language processing technology, and in particular to a method, device, and electronic device for detecting backdoors in a pre-trained language model. Background Art

[0002] In recent years, large language models have demonstrated outstanding performance in general language processing, leading to their widespread application. However, given the increasing number of parameters and scale of large language models, users often find it difficult to independently train a large language model from scratch. Instead, they rely on pre-trained language models provided by third parties for further training to obtain the corresponding large language model. However, the security of pre-trained language models provided by third parties cannot be guaranteed. Summary of the Invention

[0003] This specification provides a method, device, and electronic device for detecting backdoors in a pre-trained language model. The technical solution is as follows:

[0004] In a first aspect, this specification provides a method for detecting backdoors in a pre-trained language model, the method comprising:

[0005] Perform model twinning on the target pre-trained language model to obtain the target model and auxiliary model;

[0006] Inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining target output features output by the target model for the backdoor test text; and determining auxiliary output features output by the auxiliary model for the backdoor test text;

[0007] Model testing and training are performed on the target model based on the target output features and the auxiliary output features to obtain a model testing and training result, and backdoor detection information of the target pre-trained language model is determined based on the model testing and training result.

[0008] In a second aspect, this specification provides a pre-trained language model backdoor detection device, the device comprising:

[0009] The preprocessing module is suitable for performing model twin processing on the target pre-trained language model to obtain the target model and the auxiliary model;

[0010] a processing module adapted to input a backdoor test text into the target model, insert trainable features into the target model, determine target output features output by the target model for the backdoor test text; and determine auxiliary output features output by the auxiliary model for the backdoor test text;

[0011] The backdoor detection module is adapted to perform model test training on the target model based on the target output feature and the auxiliary output feature, obtain a model test training result, and determine the backdoor detection information of the target pre-trained language model based on the model test training result.

[0012] In a third aspect, this specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0013] In a fourth aspect, this specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0014] In a fifth aspect, the present specification provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded by a processor and executes any one of the method steps described above.

[0015] The beneficial effects brought about by the technical solutions provided in some embodiments of this specification include at least: obtaining a target model and an auxiliary model by performing model twin processing on the target pre-trained language model, then inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining the target output features output by the target model for the backdoor test text; and determining the auxiliary output features output by the auxiliary model for the backdoor test text. Since the trainable features are inserted into the target model, the target output features corresponding to the target model and the auxiliary output features corresponding to the auxiliary model are different.

[0016] When the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output feature and the auxiliary output feature is relatively large. When the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output features output by different backdoor test texts is relatively close. Therefore, the target model is trained and tested using the target output feature and the auxiliary output feature to find the corresponding trigger, thereby obtaining the model test training results. Finally, the backdoor detection information of the target pre-trained language model is determined based on the model test training results. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A schematic diagram of a pre-trained language model backdoor detection system provided in this manual;

[0019] Figure 2 A flowchart of a method for detecting backdoors in a pre-trained language model is provided for one or more embodiments of this specification;

[0020] Figure 3 A schematic diagram of a process for obtaining a target model and an auxiliary model is provided for one or more embodiments of this specification;

[0021] Figure 4 A flowchart for determining target output features output by a target model for backdoor test text is provided for one or more embodiments of this specification;

[0022] Figure 5 A flowchart of inserting trainable features into word embedding features of backdoor test text is provided for one or more embodiments of this specification;

[0023] Figure 6 A schematic diagram of a process for determining backdoor detection information of a target pre-trained language model is provided for one or more embodiments of this specification;

[0024] Figure 7 A schematic diagram of a process for determining model loss information based on target output features and auxiliary output features is provided for one or more embodiments of this specification;

[0025] Figure 8 A schematic flow chart of updating backdoor test text is provided for one or more embodiments of this specification;

[0026] Figure 9 A schematic diagram of a process for determining backdoor detection information of a target pre-trained language model is provided for one or more embodiments of this specification;

[0027] Figure 10 A schematic diagram of a process for performing information filtering on a model loss information set is provided for one or more embodiments of this specification;

[0028] Figure 11 Another flowchart of backdoor detection for a pre-trained language model is provided for one or more embodiments of this specification;

[0029] Figure 12 This is a schematic diagram of the structure of a pre-trained language model backdoor detection device provided in this manual;

[0030] Figure 13A schematic diagram of the structure of an electronic device provided in this manual;

[0031] Figure 14 A schematic diagram of the operating system and user space structure provided for this manual;

[0032] Figure 15 for Figure 14 The architecture diagram of the Android operating system;

[0033] Figure 16 for Figure 14 Architecture diagram of the IOS operating system. DETAILED DESCRIPTION

[0034] The following will clearly and completely describe the technical solutions in this specification in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments in this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this specification.

[0035] In the description of this specification, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood according to the specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0036] The present specification is described in detail below with reference to specific embodiments.

[0037] See Figure 1 , Figure 1 This is a scenario diagram of a pre-trained language model backdoor detection system provided in this manual. Figure 1 As shown, the pre-trained language model backdoor detection system may include at least a client cluster and a service platform 100.

[0038] The client cluster may include at least one client, such as Figure 1 As shown, it specifically includes client 1 corresponding to user 1, client 2 corresponding to user 2, ..., client n corresponding to user n, where n is an integer greater than 0.

[0039] Each client in a client cluster can be an electronic device with communication capabilities, including but not limited to wearable devices, handheld devices, personal computers, tablet computers, in-vehicle devices, smartphones, computing devices, or other processing devices connected to a wireless modem. Electronic devices may be referred to by different names in different networks, such as user equipment, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), and electronic devices in 5G networks or future evolution networks.

[0040] The service platform 100 can be a separate server device, such as a rack-mounted, blade, tower, or cabinet-mounted server device, or a workstation, mainframe computer, or other hardware device with strong computing capabilities; it can also be a server cluster composed of multiple servers. The servers in the service cluster can be symmetrically composed, wherein each server has equivalent functions and status in the transaction link, and each server can provide services to the outside world independently. The independent service can be understood as not requiring the assistance of other servers.

[0041] In one or more embodiments of the present specification, the service platform 100 may establish a communication connection with at least one client in the client cluster, and based on the communication connection, complete data interaction during the pre-trained language model backdoor detection process, such as online transaction data interaction. For example, the service platform 100 may push content to the client based on the backdoor detection information obtained based on the pre-trained language model backdoor detection method of the present specification; for example, the service platform 100 may obtain backdoor test data from the client, such as backdoor test text.

[0042] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication, wherein the network can be a wireless network or a wired network. Wireless networks include but are not limited to cellular networks, wireless local area networks, infrared networks, or Bluetooth networks, and wired networks include but are not limited to Ethernet, universal serial bus (USB), or controller area network. In one or more embodiments of the specification, technologies and / or formats including Hypertext Markup Language (HTML) and Extensible Markup Language (XML) are used to represent data (such as target compressed packages) exchanged over the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), and Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0043] The pre-trained language model backdoor detection system embodiment provided in this specification and the pre-trained language model backdoor detection method described in one or more embodiments are of the same concept. The execution subject corresponding to the pre-trained language model backdoor detection method involved in one or more embodiments of the specification can be the above-mentioned service platform 100; the execution subject corresponding to the pre-trained language model backdoor detection method involved in one or more embodiments of the specification can also be the electronic device corresponding to the client, which is specifically determined based on the actual application environment. The implementation process of the pre-trained language model backdoor detection system embodiment can be detailed in the following method embodiment, which will not be repeated here.

[0044] based on Figure 1 The scenario diagram shown is as follows, and the pre-trained language model backdoor detection method provided by one or more embodiments of this specification is introduced in detail.

[0045] See Figure 2 , Figure 2A flowchart illustrating a method for detecting backdoors in pre-trained language models is provided for one or more embodiments of this specification. This method can be implemented using a computer program and run on a pre-trained language model backdoor detection device based on the von Neumann architecture. The computer program can be integrated into an application or run as a standalone tool application. The pre-trained language model backdoor detection device can be a service platform.

[0046] Specifically, the pre-trained language model backdoor detection method includes:

[0047] S202: Perform model twinning processing on the target pre-trained language model to obtain a target model and an auxiliary model.

[0048] Among them, the target pre-trained language model is an artificial intelligence model that is trained using an unsupervised method on a large amount of text data and is capable of understanding and generating natural language. The target pre-trained language model is used to extract and learn the features of text data. After the target pre-trained language model undergoes model twinning processing, two identical models are obtained, namely the target model and the auxiliary model. In order to detect whether there is a backdoor in the target pre-trained language model, the target pre-trained language model is subjected to model twinning processing. At this time, the model parameters in the target pre-trained language model remain unchanged, thereby obtaining a target model and an auxiliary model that are identical to each other, thereby determining whether there is a backdoor in the target pre-trained language model through the target model and the auxiliary model. It should be noted that the target pre-trained language models include but are not limited to BERT (Bidirectional Encoder Representations from Transformers, a pre-trained language model based on Transformer) models or encoder models similar to BERT, as well as decoder models such as GPT (Generative Pre-trained Transformer, a generative pre-trained transformer model), and BART (Bidirectional Long Short-Term Memory, a bidirectional long short-term memory model) seq-to-seq models that include an encoder part. Of course, the application areas of these models need to be the field of natural language understanding tasks.

[0049] In addition, the model twinning process includes at least two operations: model parameter freezing and model copying. When the target pre-trained language model is subjected to model twinning, the target pre-trained language model can be copied to obtain two initial models, and then the two initial models are subjected to model parameter freezing to obtain a target model and an auxiliary model. Of course, when the target pre-trained language model is subjected to model twinning, the target pre-trained language model can also be subjected to model parameter freezing, and then the target model obtained after the model parameter freezing process is subjected to model copying to obtain a target model and an auxiliary model. It should be noted that the model parameter freezing process is used to set all model parameters in the model to fixed values, and these parameters are no longer updated according to the training data.

[0050] S204: Input the backdoor test text into the target model, insert trainable features into the target model, determine the target output features output by the target model for the backdoor test text; and determine the auxiliary output features output by the auxiliary model for the backdoor test text.

[0051] The backdoor test text may not have tags. The backdoor test text can be scraped and filtered from web pages using crawler technology. For example, corpus data can be scraped from online encyclopedias such as Baidu Encyclopedia and Baidu Encyclopedia. The corpus data can include different types of text content, such as document text, dialogues, articles, and film scripts. After obtaining the corpus data, it is filtered and cleaned, such as removing title paragraphs and empty paragraphs, and removing spaces at the beginning and end of the text.

[0052] For example, you can use the Wiki Text dataset provided by Hugging Face. Hugging Face is an artificial intelligence community that provides a model library, a dataset library, and several AI tools. The Wiki Text dataset is a collection of over 1.8 million text segments extracted from verified excellent and selected articles on a certain encyclopedia. After downloading, the Wiki Text dataset needs to be cleaned by removing title paragraphs and empty paragraphs, as well as removing spaces at the beginning and end of the text. Then, 2,000 samples are randomly selected from the cleaned dataset as the backdoor test text set. Each sample corresponds to a backdoor test text.

[0053] After the backdoor test text is input into the target model, the word embedding layer of the target model processes the backdoor test text to generate corresponding word embedding features. The word embedding layer is used to map the split words in the backdoor test text to the vector space to obtain the corresponding word embedding features. The trainable features are then inserted into the word embedding features. Here, the trainable features can be inserted into the word embedding features at random positions in the word embedding features.

[0054] Optionally, inserting trainable features into the target model includes: obtaining trainable features through an automated insertion program and randomly inserting the trainable features into word embedding features corresponding to the backdoor test text.

[0055] Optionally, inserting trainable features into the target model includes randomly obtaining a word from the dictionary corresponding to the target pre-trained language model and generating a trainable feature corresponding to the word, and then randomly inserting the trainable feature into the word embedding feature corresponding to the backdoor test text. The dictionary corresponding to the target pre-trained language model may be a vocabulary table or vocabulary database used by the target pre-trained language model. The trainable feature corresponding to the word may be the target word embedding feature corresponding to the word after passing through the word embedding layer.

[0056] The trainable features can be adjusted during subsequent model testing and training to perform fuzz testing. Furthermore, the adjusted trainable features can be made as close as possible to the trigger word embedding features of the word embedding layer corresponding to the trigger. Of course, the adjusted trainable features may also be the same as the trigger word embedding features of the word embedding layer corresponding to the trigger, i.e., the adjusted trainable features are the trigger word embedding features of the word embedding layer corresponding to the trigger.

[0057] It should be understood that a trigger is a specific word or phrase that triggers a backdoor. Fuzz testing is a testing method that automatically or semi-automatically inputs abnormal or random data into a system to detect errors, security vulnerabilities, or crashes in software.

[0058] After inserting trainable features into the target model, the target output features output by the target model for the backdoor test text are determined, and at the same time, the auxiliary output features output by the auxiliary model for the backdoor test text are determined. Since the trainable features are inserted into the target model, the target output features corresponding to the target model and the auxiliary output features corresponding to the auxiliary model are different. It should be understood that in order to avoid deploying the target model and the auxiliary model at the same time and to reduce the amount of computation, the auxiliary output features output by the auxiliary model for the backdoor test text can be obtained and determined in advance, and can be directly called when the auxiliary output features are needed later.

[0059] In a backdoor attack on a target pre-trained language model, the attacker maps the backdoored input (trigger) to a specific output in order to enable the backdoor to work on multiple downstream tasks corresponding to the pre-trained language model. Finding this anomalous output indicates that the target pre-trained language model contains a backdoor. When the input contains a trigger, the output of the target pre-trained language model containing the backdoor exhibits the following characteristics: First, the feature distance from benign sentences is greater; second, the feature distance between different sentences containing the same trigger decreases.

[0060] Therefore, when the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output feature and the auxiliary output feature is farther; when the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output features output by different backdoor test texts is closer.

[0061] S206: Perform model testing and training on the target model based on the target output features and the auxiliary output features to obtain a model testing and training result, and determine backdoor detection information of the target pre-trained language model based on the model testing and training result.

[0062] After obtaining the target output features corresponding to the target model and the auxiliary output features corresponding to the auxiliary model, the target model is tested and trained using the target output features and the auxiliary output features. For example, a loss function is constructed using the target output features and the auxiliary output features, and the target model is tested and trained based on the loss function value of the loss function, thereby adjusting the trainable features in the target model so that the adjusted trainable features can be as close as possible to the trigger word embedding features of the word embedding layer corresponding to the trigger, or so that the adjusted trainable features are the trigger word embedding features of the word embedding layer corresponding to the trigger.

[0063] At the same time, the model test training results are used to characterize the feature distance between the target output features and the auxiliary output features, as well as the feature distance between the target output features output by different backdoor test texts. Therefore, by obtaining the model test training results corresponding to the model test training, the backdoor detection information of the target pre-trained language model can be effectively determined.

[0064] In the embodiments provided in this specification, a target model and an auxiliary model are obtained by performing model twin processing on a target pre-trained language model, and then the backdoor test text is input into the target model, and trainable features are inserted into the target model to determine the target output features output by the target model for the backdoor test text; and the auxiliary output features output by the auxiliary model for the backdoor test text are determined. Since the trainable features are inserted into the target model, the target output features corresponding to the target model and the auxiliary output features corresponding to the auxiliary model are different.

[0065] When the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output feature and the auxiliary output feature is relatively large. When the trainable feature or the adjusted trainable feature is the trigger word embedding feature of the word embedding layer corresponding to the trigger, the feature distance between the target output features output by different backdoor test texts is relatively close. Therefore, the target model is trained and tested using the target output feature and the auxiliary output feature to find the corresponding trigger, thereby obtaining the model test training results. Finally, the backdoor detection information of the target pre-trained language model is determined based on the model test training results.

[0066] Furthermore, this solution requires no additional model training beyond model testing and training for the target model. Because abnormal features always produce abnormal output features, but abnormal inputs do not necessarily produce abnormal output features, the related art requires an additional step to identify abnormal inputs. This reduces the time overhead of this solution by 50% compared to the related art.

[0067] See Figure 3 , Figure 3 A schematic diagram of a process for obtaining a target model and an auxiliary model is provided for one or more embodiments of this specification. Figure 3 As shown, in S202, the target pre-trained language model is subjected to model twinning processing to obtain a target model and an auxiliary model, including:

[0068] S302: Freeze model parameters of the target pre-trained language model to obtain a target model.

[0069] After the target pre-trained language model is frozen, all model parameters in the target pre-trained language model are frozen, that is, all model parameters are fixed and will not change even after model training. This ensures that the target model obtained after the model parameter freezing process will not change its own model parameters during subsequent model testing and training, but will only adjust the trainable features.

[0070] Since the model parameters in the target model are all in a frozen state, the backdoor corresponding to the target pre-trained language model can be determined by searching the backdoor of the target model.

[0071] S304: Copy the target model to obtain an auxiliary model.

[0072] After obtaining the target model, the target model is copied to obtain the auxiliary model. It should be understood that since the auxiliary model is obtained by copying the target model, the auxiliary model and the target model are identical. Furthermore, since all model parameters in the target model are frozen, all model parameters in the auxiliary model are also frozen.

[0073] In the embodiments provided in this specification, a target model is obtained by freezing the model parameters of a target pre-trained language model, and an auxiliary model is obtained by copying the target model, thereby ensuring that the target model obtained after the model parameter freezing process will not change its own model parameters in subsequent model testing and training. Therefore, the auxiliary model can be used to search for the backdoor of the target model in which the trainable features are inserted, thereby determining the backdoor corresponding to the target pre-trained language model.

[0074] See Figure 4 , Figure 4 A flowchart of determining target output features output by a target model for backdoor test text is provided for one or more embodiments of this specification. Figure 4 As shown, in S204, the backdoor test text is input into the target model, trainable features are inserted into the target model, and target output features output by the target model for the backdoor test text are determined, including:

[0075] S402: Input the backdoor test text into the target model, determine the word embedding features corresponding to the backdoor test text based on the target model, insert trainable features into the word embedding features of the backdoor test text, and obtain the target word embedding features.

[0076] After the backdoor test text is input into the target model, it is preprocessed based on the Tokenizer in the target model. Tokenizer is a program or algorithm that breaks down text into individual characters or tokens. The backdoor test text is divided into tokens based on the Tokenizer in the target model. Each token is the smallest unit that the target model can recognize, usually a word. The Tokenizer also adds two special tokens, [CLS] and [SEP], at the beginning and end of a sentence, respectively. The number of dimensions of the trainable features is the same as the number of dimensions of the word embedding features, that is, the number of dimensions of the trainable features is the same as the number of dimensions of the output features of the word embedding layer. The length of the trainable feature can be set to 7, because the trigger of most language model backdoors is a word, and a word can be decomposed into up to 7 tokens. The trainable feature can also understand the trainable embedding parameters for the output features of the word embedding layer.

[0077] [CLS] is used as the input representation of the classification task, and the output vector corresponding to the symbol is used as the semantic representation of the text for text classification. The generated token sequence will first pass through the word embedding layer of the target model and be converted into the corresponding word embedding features. The target model will add a position code to each of these word embedding features to integrate the position information of the word. The position code is a vector that corresponds one-to-one to the position of the word and is added to the word embedding feature of the corresponding position. The insertion of the trainable feature of this embodiment occurs before the position code is added and after the word embedding layer outputs the word embedding feature. At the same time, the position of the trainable feature insertion is random.

[0078] After determining the word embedding features corresponding to the backdoor test text and inserting trainable features into the word embedding features corresponding to the backdoor test text, the inserted trainable features and word embedding features together constitute the target word embedding features.

[0079] See Figure 5 , Figure 5 A flowchart of inserting trainable features into word embedding features of backdoor test text is provided for one or more embodiments of this specification. Figure 5 As shown, the backdoor test text is "My dog ​​is cute", and the word embedding feature corresponding to the backdoor test text is "E 我 E 的 E 狗 E 很 E 可 E 爱 ", before encoding the word embedding features corresponding to the backdoor test text, insert the trainable feature "E" into the random position of the word embedding feature. A ” and “E B ", and then position encoding is performed on the obtained target word embedding features, such as Figure 5 As shown, the position code includes E0, E1, E2, E3, E4, E5, E6, E7, E8, E9, where E0 and E9 are respectively [CLS] and E [SEP] correspond.

[0080] S404: Control the target model to perform model processing based on the target word embedding feature to obtain the target output feature output by the target model for the target word embedding feature.

[0081] After obtaining the target word embedding feature, the target word embedding feature is further processed based on the target model to obtain the target output feature for the target word embedding feature. When the target word embedding feature contains the embedding feature corresponding to the trigger, the target output feature is usually a specific output.

[0082] In this specification, by inserting trainable features into the word embedding features of the backdoor test text, the target output features of the target model for the target word embedding features containing the trainable features are obtained, so that the trigger can be detected and tested by means of fuzzy testing, thereby providing a reference for backdoor detection of the pre-trained language model.

[0083] See Figure 6 , Figure 6 A flowchart of determining backdoor detection information of a target pre-trained language model is provided for one or more embodiments of this specification. Figure 6 As shown, in S206, the target model is tested and trained based on the target output features and the auxiliary output features to obtain a model test training result, and the backdoor detection information of the target pre-trained language model is determined based on the model test training result, including:

[0084] S602: Determine model loss information based on the target output features and the auxiliary output features, and adjust the inserted trainable features based on the model loss information.

[0085] The model loss information is used to characterize the feature distance between the target output feature and the auxiliary output feature, as well as the feature distance between the target output feature output by different backdoor test texts. The model loss information is used to adjust the trainable features inserted into the word embedding features, thereby continuously expanding the feature distance between the target output feature and the auxiliary output feature, and continuously reducing the feature distance between the target output feature output by different backdoor test texts.

[0086] This allows the trainable features to be as close as possible to the trigger word embedding features of the word embedding layer corresponding to the trigger, or allows the adjusted trainable features to be the trigger word embedding features of the word embedding layer corresponding to the trigger.

[0087] For example, the trainable features can be differentiated based on the total model loss of the target model, and the inserted trainable features can be adjusted based on the gradient obtained from the differentiation. In this embodiment, in order to improve the convergence of the target model, an adaptive learning rate mechanism is adopted. When updating the trainable features by the gradient descent method, the initial learning rate is set to 2e -3 This learning rate is larger than the value used in general BERT training. The purpose is to allow the target model to quickly find the convex hull during the model training process to improve the efficiency of model training. When the average value of the gradient backpropagated to the trainable feature is greater than 5e -3 , and then set the learning rate to 2e -5 , thereby improving the accuracy of model training.

[0088] S604: Execute the step of determining target output features output by the target model for the backdoor test text until the target model completes model detection training.

[0089] After adjusting the inserted trainable features, the target output features output by the target model for the backdoor test text are determined again; and the auxiliary output features output by the auxiliary model for the backdoor test text are determined; and model loss information is determined based on the target output features and the auxiliary output features. The inserted trainable features are adjusted based on the model loss information, and it is determined whether the target model has completed model detection training. When the target model has not completed model detection training, the step of determining the target output features output by the target model for the backdoor test text is performed again until the target model completes model detection training. When the target model completes model detection training, S506 is executed. It should be understood that when the target model completes model detection training, the target model converges.

[0090] S606: Obtain target model loss information when the target model completes model detection training, determine the model test training result based on the target model loss information, and determine the backdoor detection information of the target pre-trained language model based on the model test training result.

[0091] Among them, when the target model completes model detection training, the model loss parameter values ​​of the corresponding target model loss information have converged or the target model has undergone at least 4 rounds of training. At this time, the model loss parameter values ​​corresponding to the target model loss information can accurately represent the maximum feature distance between the target output features and the auxiliary output features and the minimum feature distance of the target output features output by different backdoor test texts, thereby quantifying whether there is a backdoor in the target pre-trained language model.

[0092] Therefore, the target model loss information can be used to determine the model test training results, and thus the backdoor detection information of the target pre-trained language model can be determined through the model test training results. In other words, it can be determined whether the target pre-trained language model has a backdoor.

[0093] This solution uses an early stopping mechanism. After the target model has been trained for at least four rounds, it will check whether the model has converged. If the model has not converged, the current cycle will be terminated, and trainable features will be regenerated to enter the next cycle.

[0094] In the embodiments provided in this specification, the inserted trainable features are adjusted by the model loss information determined by the target output features and the auxiliary output features, and then the target output features are updated again, thereby adjusting the currently inserted trainable features again by the new model loss information determined by the updated target output features and the auxiliary output features, until the target model completes the model detection training. When the target model completes the model detection training, the model loss parameter values ​​of the corresponding target model loss information have converged. At this time, the model loss parameter values ​​corresponding to the target model loss information can accurately characterize the maximum feature distance between the target output features and the auxiliary output features and the minimum feature distance of the target output features output by different backdoor test texts, thereby quantifying whether the target pre-trained language model has a backdoor.

[0095] See Figure 7 , Figure 7 A flowchart of determining model loss information based on target output features and auxiliary output features is provided for one or more embodiments of this specification. Figure 7 As shown, in S602, the model loss information is determined based on the target output feature and the auxiliary output feature, including:

[0096] S702: Determine a distance loss term based on the target output feature and the auxiliary output feature.

[0097] The corresponding distance loss term can be determined based on the target output feature and the auxiliary output feature corresponding to each backdoor test text. Based on the distance loss term, the Euclidean distance between the target output feature and the auxiliary output feature corresponding to each backdoor test text can be determined, and the negative of the average value of the Euclidean distances corresponding to all backdoor test texts can be determined.

[0098] In the embodiment provided in this specification, determining the distance loss term based on the target output feature and the auxiliary output feature in S602 includes:

[0099] The target output feature and the auxiliary output feature are calculated using the first formula to obtain the distance loss term;

[0100] The first calculation formula satisfies the following formula:

[0101] ;

[0102] Where N is the total number of backdoor test texts and N is a positive integer. is the distance loss term, Output the target feature corresponding to the x-th backdoor test text, is the auxiliary output feature corresponding to the x-th backdoor test text, MSE is the mean square error function, Used for calculation and The Euclidean distance between .

[0103] The total number of backdoor test texts is N. Each backdoor test text can be numbered or sorted to determine the sequence number of each backdoor test text. For example, if the sequence number of the backdoor test text is x, it is the xth backdoor test text.

[0104] It's easy to understand that the distance loss value corresponding to the distance loss term is used to represent the Euclidean distance between the target output feature and the auxiliary output feature. When the feature distance between the target output feature and the auxiliary output feature is greater, the Euclidean distance between the target output feature and the auxiliary output feature is greater; when the feature distance between the target output feature and the auxiliary output feature is closer, the Euclidean distance between the target output feature and the auxiliary output feature is closer. Because the backdoor test text containing the trigger is far away from the features of the benign sentence, the distance loss term is used to increase the feature distance between the target output feature and the auxiliary output feature to detect the trigger.

[0105] S704: Determine a diversity loss term based on the features of each dimension in the target output features.

[0106] A diversity loss term can be determined based on the features of each dimension in the target output features corresponding to each backdoor test text. Based on the diversity loss term, features of the same dimension in the target output features corresponding to each backdoor test text can be concatenated. The Shannon entropy of the target concatenated features corresponding to each dimension is then determined, and the negative of the average value corresponding to the total number of dimensions is calculated.

[0107] In the embodiment provided in this specification, determining the diversity loss term based on the features of each dimension in the target output feature in S704 includes:

[0108] The target output features corresponding to all backdoor test texts are concatenated by dimension features to obtain target concatenated features. Based on the target concatenated features, the second calculation formula is used to obtain the diversity loss term.

[0109] The second calculation formula satisfies the following formula:

[0110] ;

[0111] Among them, B is the total dimension of the target output feature, is the diversity loss term, is the Shannon entropy, The target concatenation feature corresponding to the y-th dimension of the target output feature corresponding to all backdoor test texts, B ≥ y ≥ 1.

[0112] The features corresponding to the y-th dimension in the target output features corresponding to all backdoor test texts are spliced ​​to obtain the target splicing features corresponding to the y-th dimension , target splicing features The number of dimensions is N. Here, feature concatenation of the features corresponding to the y-th dimension in the target output features corresponding to all backdoor test texts can be implemented based on the Stack function, which is used to concatenate features of the same dimension of a set of vectors in a new dimension.

[0113] The diversity loss term is used to reduce the differences between the features corresponding to the same dimension in the target output features corresponding to all backdoor test texts, so that all target output features of all backdoor test texts are as similar as possible. Since the distance between different backdoor test texts containing the same trigger will become closer, the trigger can be detected.

[0114] S706: Determine the total model loss for the target model based on the distance loss term and the diversity loss term, and obtain model loss information based on the distance loss term, the diversity loss term, and the total model loss.

[0115] The total model loss for the target model is determined based on the distance loss term and the diversity loss term, including:

[0116] The distance loss term and the diversity loss term are calculated using the third formula to obtain the total model loss of the target model;

[0117] The third calculation formula satisfies the following formula:

[0118] ;

[0119] in, is the total model loss of the target model, is the weight of the diversity loss term.

[0120] After obtaining the distance loss term, the diversity loss term, and the total model loss, the model loss information is determined based on the distance loss term, the diversity loss term, and the total model loss. The relative weights between the distance loss term and the diversity loss term can be balanced, and the value in this embodiment can be 1.0.

[0121] In the embodiment provided in this specification, when the total model loss corresponding to the total model loss converges, the target model completes the model detection training. At this time, when the total model loss corresponding to the total model loss reaches the minimum, the feature distance between the target output feature and the auxiliary output feature is made as large as possible, and the target output features corresponding to different backdoor test texts are as close as possible, thereby effectively realizing the detection of the trigger.

[0122] See Figure 8 , Figure 8 A schematic flow chart of updating backdoor test text is provided for one or more embodiments of this specification. Figure 8 As shown, after obtaining the target model loss information when the target model completes model detection training in S606, the following steps are also included:

[0123] S802: Record the number of model training completions for the current model detection training, and detect whether the number of model training completions is greater than or equal to a preset number.

[0124] When the target model completes model detection training for the first time, the corresponding model training completion count is 1. After the trainable features are subsequently adjusted, each time model detection training is completed, the corresponding model training completion count is increased by one, thereby recording the model training completion count of the current model detection training. The model training completion count is then compared with the preset count to determine the relative size of the model training completion count and the preset count. The preset count can be set based on specific needs and is not limited here. For example, the preset count can be 30.

[0125] S804: If not, the backdoor test text is updated to obtain the next backdoor test text, and the next backdoor test text is used as the backdoor test text and the step of inputting the backdoor test text into the target model is executed.

[0126] When the number of model training completions is less than a preset number, the backdoor test text is updated to obtain the next backdoor test text. Specifically, a batch of backdoor test texts can be extracted from the text set of backdoor test texts as the next backdoor test text, and then the next backdoor test text is used as the backdoor test text.

[0127] And executing the steps of inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining the target output features output by the target model for the backdoor test text; and determining the auxiliary output features output by the auxiliary model for the backdoor test text in S204;

[0128] And executing the step of determining model loss information based on the target output feature and the auxiliary output feature in S602, and adjusting the inserted trainable feature based on the model loss information;

[0129] and executing the step of determining the target output features output by the target model for the backdoor test text in S604 until the target model completes the model detection training;

[0130] And, obtain the target model loss information when the target model completes the model detection training, and execute step S802 again.

[0131] S806: If yes, then end the model test training.

[0132] Among them, when the number of model training completions is greater than or equal to the preset number of times, the model test training is ended, that is, the model test training is no longer performed, and the steps of determining the model test training results based on the target model loss information in S606 and determining the backdoor detection information of the target pre-trained language model based on the model test training results are executed.

[0133] In the embodiment provided in this specification, by continuously updating the backdoor test text, multiple rounds of model test training corresponding to the backdoor test text are performed to achieve continuous detection of triggers based on different backdoor test texts.

[0134] In the embodiments provided in this specification, trigger reversal, commonly used in traditional backdoor detection, is not employed. Instead, output reversal is employed. Because the feature output of the target model backdoor, when triggered, differs significantly from its normal state, reversing the output is more likely to converge. This solution also draws on fuzz testing techniques from software testing. By continuously generating random, trainable features, the likelihood of convergence is increased.

[0135] See Figure 9 , Figure 9 A flowchart of determining backdoor detection information of a target pre-trained language model is provided for one or more embodiments of this specification. Figure 9 As shown, in S606, the model test training result is determined based on the target model loss information, and the backdoor detection information of the target pre-trained language model is determined based on the model test training result, including:

[0136] S902: Determine a model loss information set based on all target model loss information, perform information filtering on the model loss information set based on preset filtering rules, and obtain a model test training result.

[0137] Among them, each time the model training is completed, the corresponding target model loss information can be obtained. Therefore, all the target model loss information can be put into the same set to obtain a model loss information set, which includes the target model loss information corresponding to each target model training completion.

[0138] After obtaining the model loss information set, the target model loss information containing interference information is filtered out. Therefore, the preset filtering rules are used to perform information filtering on the model loss information set, thereby filtering out the target model loss information containing interference information in the model loss information set and obtaining the model test training results.

[0139] S904: Determine the distance loss value distribution information of all distance loss items in the model test training results.

[0140] Among them, the distance loss values ​​of all distance loss items in the model test training results are determined, and then the corresponding distance loss value distribution information is generated based on all distance loss values.

[0141] S906: Determine backdoor detection information of the target pre-trained language model based on the distance loss value distribution information.

[0142] Among them, it is determined whether the distance loss value distribution information matches the backdoor determination condition; if it matches, the first backdoor information indicating that the target pre-trained language model has a backdoor is generated; if it does not match, the second backdoor information indicating that the target pre-trained language model does not have a backdoor is generated.

[0143] Specifically, determining whether the distance loss value distribution information matches the backdoor determination conditions includes:

[0144] Determining whether there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than a first threshold value, if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than the first threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is greater than or equal to the first threshold value, then the distance loss value distribution information does not match the backdoor determination condition; and / or,

[0145] Determine whether there are at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than a second threshold. If there are at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold, then the distance loss value distribution information matches the backdoor determination condition; if there are not at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold, then the distance loss value distribution information does not match the backdoor determination condition; wherein the second threshold is less than the first threshold.

[0146] In a feasible implementation, the first threshold value can be -0.2, the second threshold value can be -0.8, and the preset number can be 3. In the process of model detection training of the target model based on 30 batches of backdoor test texts, the batch size of each batch can be set to 32. When the number of times the distance loss value in the distance loss value distribution information is less than -0.8 is greater than or equal to 3, it indicates that the target pre-trained language model has a backdoor; when the backdoor test text is used to perform model detection training on the target model, when the distance loss value in the distance loss value distribution information is less than -0.2, it also indicates that the target pre-trained language model has a backdoor. Only when both of these conditions are not met can it be determined that the target pre-trained language model is safe. The detection accuracy of this embodiment can reach 98.0%.

[0147] See Figure 10 , Figure 10 A schematic diagram of a process for filtering out information from a model loss information set is provided for one or more embodiments of this specification. Figure 10 As shown, in S902, the model loss information set is filtered based on the preset filtering rules to obtain the model test training results, including:

[0148] S1002: Determine a diversity loss threshold, determine a target diversity loss item whose diversity loss value is greater than the diversity loss threshold from the model loss information set, and determine first target model loss information corresponding to the target diversity loss item.

[0149] Among them, in order to avoid the situation where the distance loss value corresponding to the distance loss item decreases while the diversity loss value corresponding to the diversity loss item does not decrease during the model test training of the target model, the corresponding diversity loss threshold can be determined based on the actual scenario, and the model loss information set corresponding to the model test training is used to search for the target diversity loss item whose diversity loss value is greater than the diversity loss threshold. At this time, the diversity loss values ​​all correspond to the target model after the model test training is completed.

[0150] Therefore, if the target diversity loss term has a diversity loss value greater than the diversity loss threshold, this can be interpreted as a situation where the distance loss value corresponding to the distance loss term decreases during model testing and training, while the diversity loss value corresponding to the diversity loss term does not. Subsequently, the model loss information corresponding to the target diversity loss term is used as the first target model loss information. In one feasible implementation, the diversity loss threshold can be -3.446.

[0151] S1004: Determine the reference trainable features corresponding to each model loss information in the model loss information set, obtain the word embedding feature value range corresponding to the target model, match the reference trainable features based on the word embedding feature value range, obtain the target trainable features that do not match the word embedding feature value range, and determine the second target model loss information corresponding to the target trainable features.

[0152] To avoid excessive adjustments to trainable features that would exceed the target model's corresponding word embedding feature value range, rendering adjustments to the trainable features meaningless, we obtain the reference trainable features corresponding to each model loss information in the model loss information set, then match the word embedding feature value range to the reference trainable features to obtain the target trainable features that do not match the word embedding feature value range.

[0153] A target trainable feature that does not match the word embedding feature value range indicates that the adjustment range of the target trainable feature is too large, causing the target trainable feature to exceed the word embedding feature value range corresponding to the target model, making the value of the target trainable feature meaningless. The model loss information corresponding to the target trainable feature is then used as the second target model loss information.

[0154] S1006: Filter out the first target model loss information and the second target model loss information from the model loss information set to obtain a model test training result.

[0155] Among them, after obtaining the first target model loss information and the second target model loss information, the preset filtering rules are determined based on the first target model loss information and the second target model loss information, and then the first target model loss information and the second target model loss information are filtered out from the model loss information set through the preset filtering rules to obtain the model test training results.

[0156] In the embodiments provided in this specification, in order to avoid the situation where the distance loss value corresponding to the distance loss item decreases while the diversity loss value corresponding to the diversity loss item does not decrease during the model test training of the target model, the first target model loss information corresponding to this situation is determined, and to avoid the situation where the adjustment range of the trainable feature is too large, causing it to exceed the value range of the word embedding feature corresponding to the target model, the second target model loss information corresponding to this situation is determined, and then the first target model loss information and the second target model loss information are filtered out from the model loss information set to obtain the model test training result, thereby performing interference information filtering processing on the model loss information set.

[0157] See Figure 11 , Figure 11Another flow chart of backdoor detection of pre-trained language model is provided for one or more embodiments of this specification. Figure 11 As shown, the target pre-trained language model is subjected to model twinning processing to obtain a target model and an auxiliary model. The backdoor test text is crawled from the web page based on a crawler, and trainable features are inserted into the target model. Then, the target model is tested and trained based on the target output features and the auxiliary output features.

[0158] If the reference distance loss value of a reference distance loss item in the distance loss value distribution information is less than the first threshold, the distance loss value distribution information matches the backdoor judgment condition, indicating that the abnormal output set is not empty, and the target pre-trained language model has a backdoor; if the target distance loss value of at least a preset number of target distance loss items in the distance loss value distribution information is less than the second threshold, the distance loss value distribution information matches the backdoor judgment condition, indicating that the output reverse is abnormal, and the target pre-trained language model also has a backdoor.

[0159] The following will be combined Figure 12 , Figure 12 This is a schematic diagram of the structure of a pre-trained language model backdoor detection device provided in this manual. It should be noted that, Figure 12 The pre-trained language model backdoor detection device shown is used to execute this instruction Figures 1 to 11 For the sake of convenience, only the parts related to this specification are shown. For the specific technical details not disclosed, please refer to this specification. Figures 1 to 11 The embodiment shown.

[0160] See Figure 12 , which shows a schematic diagram of the structure of the pre-trained language model backdoor detection device of this specification. The pre-trained language model backdoor detection device 1 can be implemented as all or part of the user terminal through software, hardware, or a combination of both. According to some embodiments, the pre-trained language model backdoor detection device 1 includes a pre-processing module 11, a processing module 12, and a backdoor detection module 13, which are specifically used to:

[0161] A preprocessing module 11 is adapted to perform model twinning processing on the target pre-trained language model to obtain a target model and an auxiliary model;

[0162] The processing module 12 is adapted to input the backdoor test text into the target model, insert trainable features into the target model, determine target output features output by the target model for the backdoor test text; and determine auxiliary output features output by the auxiliary model for the backdoor test text;

[0163] The backdoor detection module 13 is adapted to perform model test training on the target model based on the target output features and the auxiliary output features, obtain the model test training results, and determine the backdoor detection information of the target pre-trained language model based on the model test training results.

[0164] Optionally, the preprocessing module 11 includes:

[0165] A model parameter freezing unit, adapted to freeze the model parameters of a target pre-trained language model to obtain a target model;

[0166] The model copying unit is suitable for copying the target model to obtain an auxiliary model.

[0167] Optionally, the processing module 12 includes:

[0168] an input unit adapted to input a backdoor test text into a target model, determine a word embedding feature corresponding to the backdoor test text based on the target model, and insert a trainable feature into the word embedding feature of the backdoor test text to obtain a target word embedding feature;

[0169] The control unit is suitable for controlling the target model to perform model processing based on the target word embedding feature to obtain the target output feature output by the target model for the target word embedding feature.

[0170] Optionally, the backdoor detection module 13 includes:

[0171] an adjustment unit, adapted to determine model loss information based on the target output feature and the auxiliary output feature, and adjust the inserted trainable features based on the model loss information;

[0172] an execution unit, adapted to execute the step of determining target output features output by the target model for the backdoor test text until the target model completes model detection training;

[0173] The acquisition unit is adapted to obtain target model loss information when the target model completes model detection training, determine the model test training result based on the target model loss information, and determine the backdoor detection information of the target pre-trained language model based on the model test training result.

[0174] Optionally, the adjustment unit includes:

[0175] a distance loss term determination subunit, adapted to determine a distance loss term based on the target output feature and the auxiliary output feature;

[0176] A diversity loss term determination subunit, adapted to determine a diversity loss term based on features of each dimension in the target output feature;

[0177] The model loss information determination subunit is suitable for determining the total model loss for the target model based on the distance loss term and the diversity loss term, and obtaining the model loss information based on the distance loss term, the diversity loss term and the total model loss.

[0178] Optionally, the distance loss item determination subunit includes:

[0179] A first calculation formula subunit is adapted to obtain a distance loss term by applying a first calculation formula to the target output feature and the auxiliary output feature;

[0180] The first calculation formula satisfies the following formula:

[0181] ;

[0182] Where N is the total number of backdoor test texts and N is a positive integer. is the distance loss term, Output the target feature corresponding to the x-th backdoor test text, is the auxiliary output feature corresponding to the x-th backdoor test text, MSE is the mean square error function, Used for calculation and The Euclidean distance between

[0183] The subunits for determining diversity loss include:

[0184] The second calculation formula sub-unit is adapted to perform dimensional feature concatenation on the target output features corresponding to all backdoor test texts to obtain a target concatenated feature, and to obtain a diversity loss term based on the target concatenated feature using the second calculation formula;

[0185] The second calculation formula satisfies the following formula:

[0186] ;

[0187] Among them, B is the total dimension of the target output feature, is the diversity loss term, is the Shannon entropy, The target concatenation feature corresponding to the y-th dimension of the target output feature corresponding to all backdoor test texts, B ≥ y ≥ 1;

[0188] The model loss information determination subunit includes:

[0189] The distance loss term and the diversity loss term are calculated using the third formula to obtain the total model loss of the target model;

[0190] The third calculation formula satisfies the following formula:

[0191] ;

[0192] in, is the total model loss of the target model, is the weight of the diversity loss term.

[0193] Optionally, the acquiring unit further includes:

[0194] The recording subunit is adapted to record the number of model training completions of the currently completed model detection training, and detect whether the number of model training completions is greater than or equal to a preset number;

[0195] a first judgment subunit adapted to, if not, update the backdoor test text to obtain a next backdoor test text, use the next backdoor test text as the backdoor test text, and execute the step of inputting the backdoor test text into the target model;

[0196] The second judgment subunit is adapted to end the model test training if yes.

[0197] Optionally, the acquiring unit includes:

[0198] A filtering subunit is adapted to determine a model loss information set based on all target model loss information, and to perform information filtering processing on the model loss information set based on a preset filtering rule to obtain a model test training result;

[0199] A distance loss value distribution information determination subunit, adapted to determine the distance loss value distribution information of all distance loss items in the model test training results;

[0200] The backdoor detection information determination subunit is adapted to determine the backdoor detection information of the target pre-trained language model based on the distance loss value distribution information.

[0201] Optionally, the filtering subunit includes:

[0202] a first determining subunit, adapted to determine a diversity loss threshold, determine a target diversity loss item whose diversity loss value is greater than the diversity loss threshold from the model loss information set, and determine first target model loss information corresponding to the target diversity loss item;

[0203] A second determining subunit is adapted to determine a reference trainable feature corresponding to each model loss information in the model loss information set, obtain a word embedding feature value range corresponding to the target model, match the reference trainable feature based on the word embedding feature value range, obtain a target trainable feature that does not match the word embedding feature value range, and determine a second target model loss information corresponding to the target trainable feature;

[0204] The model test training result determination subunit is adapted to filter out the first target model loss information and the second target model loss information from the model loss information set to obtain the model test training result.

[0205] Optionally, the backdoor detection information determination subunit includes:

[0206] a matching judgment subunit, adapted to judge whether the distance loss value distribution information matches the backdoor judgment condition;

[0207] a matching subunit, adapted to generate first backdoor information indicating that a backdoor exists in the target pre-trained language model if a match occurs;

[0208] The unmatched subunit is adapted to generate second backdoor information indicating that the target pre-trained language model does not have a backdoor if there is no match.

[0209] Optionally, the matching judgment subunit is adapted to:

[0210] Determining whether there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than a first threshold value, if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than the first threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is greater than or equal to the first threshold value, then the distance loss value distribution information does not match the backdoor determination condition; and / or,

[0211] Determine whether there are at least a preset number of target distance loss items in the distance loss value distribution information whose reference distance loss values ​​are less than a second threshold value. If there are at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there are not at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold value, then the distance loss value distribution information does not match the backdoor determination condition; wherein the second threshold value is less than the first threshold value.

[0212] It should be noted that the pre-trained language model backdoor detection device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example when executing the pre-trained language model backdoor detection method. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the pre-trained language model backdoor detection device provided in the above embodiment and the pre-trained language model backdoor detection method embodiment are based on the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0213] This specification also provides a computer storage medium, which can store multiple instructions, which are suitable for being loaded and executed by a processor as described above. Figures 1 to 11The pre-trained language model backdoor detection method of the embodiment shown in the figure can be found in the specific execution process. Figures 1 to 11 The detailed description of the illustrated embodiment will not be repeated here.

[0214] This specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figures 1 to 11 The pre-trained language model backdoor detection method of the embodiment shown in the figure can be found in the specific execution process. Figures 1 to 11 The detailed description of the illustrated embodiment will not be repeated here.

[0215] Please refer to Figure 13 , Figure 13 This is a schematic diagram of the structure of an electronic device provided in this specification. The electronic device described in this specification may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0216] The processor 110 may include one or more processing cores. Using various interfaces and circuits, the processor 110 connects to various components within the electronic device. It executes instructions, programs, code sets, or instruction sets stored in the memory 120, as well as accesses data stored in the memory 120, to perform various functions and process data within the electronic device 100. Optionally, the processor 110 may be implemented in hardware using at least one of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 110 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. The CPU primarily handles the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem handles wireless communications. It is understood that the modem may also be implemented independently of the processor 110 via a separate communications chip.

[0217] The memory 120 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an iOS system developed by Apple, including a system deeply developed based on the iOS system, or other systems. The data storage area may also store data created by the electronic device during use, such as a phone book, audio and video data, chat history data, etc.

[0218] See also Figure 14 As shown, Figure 14 A structural diagram of the operating system and user space provided in this specification. The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve better operating results, the operating system allocates corresponding system resources to different third-party applications. However, different application scenarios in the same third-party application also have different requirements for system resources. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and the third-party application are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0219] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0220] Figure 15 for Figure 14 The architecture diagram of the Android operating system in FIG. 1 is shown. Taking the Android operating system as an example, the programs and data stored in the memory 120 are as follows: Figure 15 As shown, the memory 120 may store a Linux kernel layer 320, a system runtime library layer 340, an application framework layer 360, and an application layer 380. The Linux kernel layer 320, the system runtime library layer 340, and the application framework layer 360 belong to the operating system space, and the application layer 380 belongs to the user space. The Linux kernel layer 320 provides underlying drivers for various hardware components of electronic devices, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, power management, etc. The system runtime library layer 340 provides major feature support for the Android system through some C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D drawing support, and the Webkit library provides browser kernel support. The system runtime library layer 340 also provides the Android runtime library (Android runtime), which mainly provides some core libraries that allow developers to write Android applications using the Java language. The application framework layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider management, package management, call management, resource management, and location management. The application layer 380 runs at least one application. These applications can be native applications that come with the operating system, such as contacts, SMS, clock, and camera applications, or third-party applications developed by third-party developers, such as games, instant messaging programs, and photo enhancement programs.

[0221] Figure 16 for Figure 14 The architecture diagram of the IOS operating system in FIG. 1 is shown. Taking the operating system as the IOS system as an example, the programs and data stored in the memory 120 are as follows: Figure 16As shown, the iOS system includes: a core operating system layer 420 (Core OS layer), a core services layer 440 (Core Services layer), a media layer 460 (Media layer), and a touch layer 480 (Cocoa Touch Layer). The core operating system layer 420 includes the operating system kernel, drivers, and underlying program frameworks. These underlying program frameworks provide hardware-closer functionality for use by the program frameworks in the core services layer 440. The core services layer 440 provides system services and / or program frameworks required by applications, such as the Foundation framework, account framework, advertising framework, data storage framework, network connection framework, geolocation framework, and motion framework. The media layer 460 provides applications with audio-visual interfaces, such as graphics and image interfaces, audio and video technology interfaces, and wireless playback (AirPlay) interfaces for audio and video transmission. The touch layer 480 provides various commonly used interface-related frameworks for application development and is responsible for user touch interaction on electronic devices. For example, local notification service, remote push service, advertising framework, game tool framework, message user interface (UI) framework, user interface UIKit framework, map framework, etc.

[0222] exist Figure 16 Among the frameworks shown, those relevant to most applications include, but are not limited to, the Foundation framework in the core services layer 440 and the UIKit framework in the touchable layer 480. The Foundation framework provides many basic object classes and data types, offering fundamental system services for all applications and having nothing to do with the UI. The classes provided by the UIKit framework are the foundational UI class library for creating touch-based user interfaces. iOS applications can use the UIKit framework to provide their UIs, providing the application infrastructure for building user interfaces, drawing, handling user interaction events, responding to gestures, and so on.

[0223] Among them, the method and principle of implementing data communication between third-party applications and the operating system in the IOS system can be referred to the Android system, and this manual will not go into details here.

[0224] Among them, the input device 130 is used to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone or a touch device. The output device 140 is used to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays, which are used to receive touch operations on or near the touch screen using any suitable object such as a finger or a touch pen, and to display the user interface of each application. The touch screen display is usually provided on the front panel of the electronic device. The touch screen display can be designed as a full screen, a curved screen or a special-shaped screen. The touch screen display can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in this specification.

[0225] In addition, those skilled in the art will understand that the structures of the electronic devices shown in the above figures do not limit the electronic devices. The electronic devices may include more or fewer components than shown, or may combine certain components or arrange the components differently. For example, the electronic devices may also include radio frequency circuits, input units, sensors, audio circuits, wireless fidelity (WiFi) modules, power supplies, Bluetooth modules, and other components, which will not be described in detail here.

[0226] In this specification, the execution entity of each step can be the electronic device described above. Optionally, the execution entity of each step is the operating system of the electronic device. The operating system can be Android, iOS, or other operating systems, which is not limited in this specification.

[0227] The electronic device of this specification may also be equipped with a display device. The display device may be any device capable of displaying a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), etc. The user may use the display device on the electronic device 101 to view displayed text, images, videos, and other information. The electronic device may be a smartphone, a tablet computer, a gaming device, an AR (Augmented Reality) device, a car, a data storage device, an audio player, a video player, a notebook, a desktop computing device, or a wearable device such as an electronic watch, electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, or electronic clothing.

[0228] exist Figure 13 In the electronic device shown, which may be a terminal, the processor 110 may be configured to call a network optimization application stored in the memory 120 and specifically perform the following operations:

[0229] Perform model twinning on the target pre-trained language model to obtain the target model and auxiliary model;

[0230] Inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining target output features output by the target model for the backdoor test text; and determining auxiliary output features output by the auxiliary model for the backdoor test text;

[0231] The target model is tested and trained based on the target output features and the auxiliary output features to obtain a model test training result, and the backdoor detection information of the target pre-trained language model is determined based on the model test training result.

[0232] Optionally, when the processor 110 performs model twinning processing on the target pre-trained language model to obtain the target model and the auxiliary model, the processor 110 specifically performs:

[0233] Freeze the model parameters of the target pre-trained language model to obtain the target model;

[0234] Copy the target model to obtain the auxiliary model.

[0235] Optionally, when the processor 110 inputs the backdoor test text into the target model, inserts trainable features into the target model, and determines the target output features output by the target model for the backdoor test text, the processor 110 specifically performs:

[0236] Input the backdoor test text into the target model, determine the word embedding features corresponding to the backdoor test text based on the target model, insert the trainable features into the word embedding features of the backdoor test text, and obtain the target word embedding features;

[0237] The target model is controlled to perform model processing based on the target word embedding feature to obtain the target output feature output by the target model for the target word embedding feature.

[0238] Optionally, the processor 110 performs model test training on the target model based on the target output feature and the auxiliary output feature to obtain a model test training result, and determines the backdoor detection information of the target pre-trained language model based on the model test training result, specifically performing:

[0239] Determine model loss information based on the target output features and the auxiliary output features, and adjust the inserted trainable features based on the model loss information;

[0240] Executing the step of determining target output features output by the target model for the backdoor test text until the target model completes model detection training;

[0241] Obtain target model loss information when the target model completes model detection training, determine the model test training result based on the target model loss information, and determine the backdoor detection information of the target pre-trained language model based on the model test training result.

[0242] Optionally, when the processor 110 determines the model loss information based on the target output feature and the auxiliary output feature, it specifically performs:

[0243] Determine the distance loss term based on the target output features and the auxiliary output features;

[0244] Determine the diversity loss term based on the characteristics of each dimension in the target output feature;

[0245] The total model loss for the target model is determined based on the distance loss term and the diversity loss term, and the model loss information is obtained based on the distance loss term, the diversity loss term and the total model loss.

[0246] Optionally, when the processor 110 determines the distance loss term based on the target output feature and the auxiliary output feature, it specifically performs:

[0247] The target output feature and the auxiliary output feature are calculated using the first formula to obtain the distance loss term;

[0248] The first calculation formula satisfies the following formula:

[0249] ;

[0250] Where N is the total number of backdoor test texts and N is a positive integer. is the distance loss term, Output the target feature corresponding to the x-th backdoor test text, is the auxiliary output feature corresponding to the x-th backdoor test text, MSE is the mean square error function, Used for calculation and The Euclidean distance between

[0251] When the processor 110 determines the diversity loss term based on the features of each dimension in the target output feature, it specifically performs:

[0252] The target output features corresponding to all backdoor test texts are concatenated by dimension features to obtain target concatenated features. Based on the target concatenated features, the second calculation formula is used to obtain the diversity loss term.

[0253] The second calculation formula satisfies the following formula:

[0254] ;

[0255] Among them, B is the total dimension of the target output feature, is the diversity loss term, is the Shannon entropy, The target concatenation feature corresponding to the y-th dimension of the target output feature corresponding to all backdoor test texts, B ≥ y ≥ 1;

[0256] When the processor 110 determines the total model loss for the target model based on the distance loss term and the diversity loss term, it specifically performs:

[0257] The distance loss term and the diversity loss term are calculated using the third formula to obtain the total model loss of the target model;

[0258] The third calculation formula satisfies the following formula:

[0259] ;

[0260] in, is the total model loss of the target model, is the weight of the diversity loss term.

[0261] Optionally, after executing the step of obtaining target model loss information when the target model completes model detection training, the processor 110 is further adapted to execute:

[0262] Record the number of completed model trainings for the current model detection training, and check whether the number of completed model trainings is greater than or equal to the preset number;

[0263] If not, the backdoor test text is updated to obtain the next backdoor test text, the next backdoor test text is used as the backdoor test text, and the step of inputting the backdoor test text into the target model is performed;

[0264] If yes, the model test training ends.

[0265] Optionally, when the processor 110 determines the model test training result based on the target model loss information and determines the backdoor detection information of the target pre-trained language model based on the model test training result, the processor 110 specifically performs:

[0266] Determine the model loss information set based on all target model loss information, perform information filtering on the model loss information set based on preset filtering rules, and obtain the model test training results;

[0267] Determine the distance loss value distribution information of all distance loss items in the model test training results;

[0268] Determine backdoor detection information of the target pre-trained language model based on the distance loss value distribution information.

[0269] Optionally, the processor 110 performs information filtering processing on the model loss information set based on a preset filtering rule, and when obtaining the model test training result, specifically performs:

[0270] Determining a diversity loss threshold, determining a target diversity loss item whose diversity loss value is greater than the diversity loss threshold from the model loss information set, and determining first target model loss information corresponding to the target diversity loss item;

[0271] Determine a reference trainable feature corresponding to each model loss information in the model loss information set, obtain a word embedding feature value range corresponding to the target model, match the reference trainable feature based on the word embedding feature value range, obtain a target trainable feature that does not match the word embedding feature value range, and determine a second target model loss information corresponding to the target trainable feature;

[0272] The first target model loss information and the second target model loss information are filtered out from the model loss information set to obtain the model test training result.

[0273] Optionally, when the processor 110 determines the backdoor detection information of the target pre-trained language model based on the distance loss value distribution information, it specifically performs:

[0274] Determine whether the distance loss value distribution information matches the backdoor judgment condition;

[0275] If they match, the first backdoor information indicating that the target pre-trained language model has a backdoor is generated;

[0276] If there is no match, second backdoor information indicating that the target pre-trained language model does not have a backdoor is generated.

[0277] Optionally, when the processor 110 determines whether the distance loss value distribution information matches the backdoor determination condition, it specifically performs:

[0278] Determining whether there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than a first threshold value, if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is less than the first threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there is a reference distance loss item in the distance loss value distribution information whose reference distance loss value is greater than or equal to the first threshold value, then the distance loss value distribution information does not match the backdoor determination condition; and / or,

[0279] Determine whether there are at least a preset number of target distance loss items in the distance loss value distribution information whose reference distance loss values ​​are less than a second threshold value. If there are at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there are not at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold value, then the distance loss value distribution information does not match the backdoor determination condition; wherein the second threshold value is less than the first threshold value.

[0280] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0281] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, storage, and display, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the object characteristics, interactive behavior characteristics, and user information mentioned in this specification are all obtained with full authorization.

[0282] The above disclosure is only a preferred embodiment of this specification, and certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A method for detecting backdoors in a pre-trained language model, the method include: Perform model twinning processing on the target pre-trained language model to obtain the target model and the auxiliary model; Inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining the target output features output by the target model for the backdoor test text; and determining the auxiliary output features output by the auxiliary model for the backdoor test text; The step of inputting the backdoor test text into the target model, inserting trainable features into the target model, and determining target output features output by the target model for the backdoor test text includes: Inputting the backdoor test text into the target model, determining the word embedding features corresponding to the backdoor test text based on the target model, inserting trainable features into the word embedding features of the backdoor test text to obtain target word embedding features; controlling the target model to perform model processing based on the target word embedding features to obtain target output features output by the target model for the target word embedding features; Performing model test training on the target model based on the target output feature and the auxiliary output feature to obtain a model test training result, and determining backdoor detection information of the target pre-trained language model based on the model test training result; Among them, the model test training result is used to characterize the feature distance between the target output feature and the auxiliary output feature and the feature distance between the target output feature corresponding to different backdoor test texts.

2. According to the method of claim 1, the target pre-trained language model is subjected to model twinning processing to obtain a target model and an auxiliary model, include: Freezing the model parameters of the target pre-trained language model to obtain a target model; The target model is copied to obtain an auxiliary model.

3. According to the method of claim 1, the target model is subjected to model test training based on the target output feature and the auxiliary output feature to obtain a model test training result, and the backdoor detection information of the target pre-trained language model is determined based on the model test training result. include: Determining model loss information based on the target output feature and the auxiliary output feature, and adjusting the inserted trainable feature based on the model loss information; Executing the step of determining the target output feature output by the target model for the backdoor test text until the target model completes model detection training; Obtain target model loss information when the target model completes the model detection training, determine a model test training result based on the target model loss information, and determine backdoor detection information of the target pre-trained language model based on the model test training result.

4. The method according to claim 3, wherein the model loss information is determined based on the target output feature and the auxiliary output feature. include: Determining a distance loss term based on the target output feature and the auxiliary output feature; Determining a diversity loss item based on the features of each dimension in the target output feature; A total model loss for the target model is determined based on the distance loss term and the diversity loss term, and model loss information is obtained based on the distance loss term, the diversity loss term and the total model loss.

5. The method according to claim 4, wherein the distance loss term is determined based on the target output feature and the auxiliary output feature. include: The target output feature and the auxiliary output feature are calculated using a first formula to obtain a distance loss term; The first calculation formula satisfies the following formula: ； Wherein, N is the total number of the backdoor test texts and N is a positive integer, is the distance loss term, is the target output feature corresponding to the x-th backdoor test text, is the auxiliary output feature corresponding to the x-th backdoor test text, the MSE is the mean square error function, and To calculate the and stated The Euclidean distance between The determining of the diversity loss item based on the features of each dimension in the target output feature includes: Performing dimension feature concatenation on the target output features corresponding to all backdoor test texts to obtain a target concatenation feature, and obtaining a diversity loss term based on the target concatenation feature using a second calculation formula; The second calculation formula satisfies the following formula: ； Wherein, B is the total dimension of the target output feature, is the diversity loss term, is the Shannon entropy, The target concatenation feature corresponding to the yth dimension of the target output feature corresponding to all backdoor test texts, wherein B≥y≥1; The determining the total model loss for the target model based on the distance loss term and the diversity loss term includes: The distance loss term and the diversity loss term are calculated using a third formula to obtain a total model loss of the target model; The third calculation formula satisfies the following formula: ； Among them, the is the total model loss of the target model, is the weight of the diversity loss term.

6. The method according to claim 3, after obtaining the target model loss information when the target model completes the model detection training, further include: Record the number of model training completions of the current model detection training, and detect whether the number of model training completions is greater than or equal to a preset number; If not, the backdoor test text is updated to obtain a next backdoor test text, the next backdoor test text is used as the backdoor test text, and the step of inputting the backdoor test text into the target model is performed; If yes, the model test training ends.

7. The method according to claim 6, wherein the model test training result is determined based on the target model loss information, and the backdoor detection information of the target pre-trained language model is determined based on the model test training result. include: Determine a model loss information set based on all target model loss information, and perform information filtering on the model loss information set based on a preset filtering rule to obtain a model test training result; Determine the distance loss value distribution information of all distance loss items in the model test training results; Backdoor detection information of the target pre-trained language model is determined based on the distance loss value distribution information.

8. The method according to claim 7, wherein the model loss information set is subjected to information filtering based on a preset filtering rule to obtain a model test training result. include: Determine a diversity loss threshold, determine a target diversity loss item whose diversity loss value is greater than the diversity loss threshold from the model loss information set, and determine first target model loss information corresponding to the target diversity loss item; Determine a reference trainable feature corresponding to each model loss information in the model loss information set, obtain a word embedding feature value range corresponding to the target model, match the reference trainable feature based on the word embedding feature value range, obtain a target trainable feature that does not match the word embedding feature value range, and determine a second target model loss information corresponding to the target trainable feature; The first target model loss information and the second target model loss information are filtered out from the model loss information set to obtain a model test training result.

9. The method according to claim 7, wherein the backdoor detection information of the target pre-trained language model is determined based on the distance loss value distribution information. include: Determining whether the distance loss value distribution information matches the backdoor determination condition; If they match, generating first backdoor information indicating that the target pre-trained language model has a backdoor; If they do not match, second backdoor information indicating that the target pre-trained language model does not have a backdoor is generated.

10. The method according to claim 9, wherein the determining whether the distance loss value distribution information matches the backdoor determination condition, include: Determine whether there is a reference distance loss value of a reference distance loss item in the distance loss value distribution information that is less than a first threshold value; if there is a reference distance loss value of a reference distance loss item in the distance loss value distribution information that is less than the first threshold value, then the distance loss value distribution information matches the backdoor determination condition; if there is a reference distance loss value of a reference distance loss item in the distance loss value distribution information that is greater than or equal to the first threshold value, then the distance loss value distribution information does not match the backdoor determination condition; and / or, Determine whether there are at least a preset number of target distance loss items in the distance loss value distribution information whose reference distance loss values ​​are less than a second threshold; if there are at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold, then the distance loss value distribution information matches the backdoor determination condition; if there are no at least a preset number of target distance loss items in the distance loss value distribution information whose target distance loss values ​​are less than the second threshold, then the distance loss value distribution information does not match the backdoor determination condition; wherein the second threshold is less than the first threshold.

11. A pre-trained language model backdoor detection device, the device include: The preprocessing module is suitable for performing model twin processing on the target pre-trained language model to obtain the target model and the auxiliary model; A processing module, adapted to input the backdoor test text into the target model, insert trainable features into the target model, and determine target output features output by the target model for the backdoor test text; And, determining the auxiliary output features output by the auxiliary model for the backdoor test text; The processing module comprises: An input unit, adapted to input a backdoor test text into the target model, determine a word embedding feature corresponding to the backdoor test text based on the target model, insert a trainable feature into the word embedding feature of the backdoor test text, and obtain a target word embedding feature; A control unit, adapted to control the target model to perform model processing based on the target word embedding feature to obtain a target output feature output by the target model for the target word embedding feature; A backdoor detection module, adapted to perform model test training on the target model based on the target output feature and the auxiliary output feature, obtain a model test training result, and determine the backdoor detection information of the target pre-trained language model based on the model test training result; Among them, the model test training result is used to characterize the feature distance between the target output feature and the auxiliary output feature and the feature distance between the target output feature corresponding to different backdoor test texts.

12. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps as claimed in any one of claims 1 to 10.

13. A computer program product, the computer program product storing at least one instruction, wherein the at least one instruction is loaded by a processor and executes the method steps according to any one of claims 1 to 10.

14. An electronic device, include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 10.

Images