Anti-backdoor classification method and system for SAR images based on backdoor feature extraction and optimization

Abstract

The present invention discloses a SAR image anti-backdoor classification method and system based on backdoor feature extraction optimization. The method includes: constructing a backdoor feature extraction subnetwork and a classification subnetwork based on network blocks; performing particle position and velocity encoding on the neural network architecture parameters, backdoor feature selection parameters, and pruning position parameters of the SAR image anti-backdoor classification model composed of the two subnetworks; taking the parameter quantity, backdoor attack success rate, and classification accuracy of normal samples of the SAR image anti-backdoor classification model as optimization targets; designing an offline optimization platform based on a three-objective particle swarm optimization method; and obtaining an online deployment model for SAR image classification that balances lightweight, high precision, and strong backdoor robustness. The present invention realizes the automatic optimization design of the SAR image anti-backdoor classification model. The constructed backdoor feature extraction subnetwork expands the processing method of backdoor features, improving the model's lightweight, classification accuracy, and backdoor robustness.

Description

Technical Field

[0001] The present invention relates to the field of automatic deep learning technology in the field of information security of synthetic aperture radar image classification models, which takes into account the optimal comprehensive performance such as model lightweight, high classification accuracy and strong backdoor robustness, and in particular to a SAR image anti-backdoor classification method and system based on backdoor feature extraction optimization. Background Art

[0002] Synthetic Aperture Radar (SAR) systems, unaffected by weather and capable of providing high-resolution surveillance images of target areas at any time, have been widely used in battlefield surveillance, fire control, guidance, navigation, resource surveying, mapping, ocean surveillance, and environmental remote sensing. When SAR image classification models in these fields misclassify or are attacked maliciously, they can potentially provide erroneous information for the judgment and decision-making of relevant national agencies or departments, leading to catastrophic consequences. Therefore, in these areas involving important national strategic deployments, the classification accuracy and robustness of SAR image classification models are crucial. At the same time, in some edge computing scenarios with limited hardware resources, achieving a good balance between model lightweightness and performance is often difficult. Therefore, in response to the increasing demand for SAR application deployment and national strategic security requirements, the development of SAR image classification systems that balance high classification accuracy, strong robustness, and lightweightness is urgently needed.

[0003] In the field of SAR image classification, the recent rise of deep learning technology has brought new solutions and application prospects to the problem. However, the accompanying threat of backdoor attacks has also become a new challenge in SAR image classification research, seriously hindering the application and promotion of SAR image classification models. Backdoor attacks embed backdoors in the model during the training phase, causing the model to produce the attacker's desired predictions during application. This poses a serious threat to the security of SAR image classification models and is highly stealthy. The embedded backdoors typically do not interfere with the classification results of normal samples, making it difficult for users to detect the embedded backdoors. Furthermore, in the research of SAR image classification models, current model architectures are based on classical image classification models, manually designed and fine-tuned by experts based on experience. This requires a significant amount of time and effort for trial and error. As a result, existing SAR image classification models often suffer from complex structures, poor robustness, and difficulty in flexibly adapting to different classification scenarios. While existing automated deep learning technologies can address these issues to some extent, the inherent characteristics of SAR images, such as large size, physical occlusions, image speckle noise, and dataset imbalance, complicate the direct application of traditional automated machine learning techniques to SAR image classification. Therefore, neural architecture search and hyperparameter optimization of SAR image classification models that take into account the characteristics of SAR images while achieving high classification accuracy, backdoor attack robustness and lightweightness remain technical challenges that need to be urgently solved in the field of SAR image classification.

[0004] While backdoor attack techniques targeting SAR image classification models have been reported in existing research, backdoor defense techniques for these models have not. Furthermore, existing automated deep learning techniques for SAR image classification models have not yet addressed the multi-objective parallel optimization of backdoor defense performance metrics, model lightweighting, and classification accuracy. Therefore, to meet the engineering requirements for SAR image classification applications that require optimal performance, balancing lightweight models, high classification accuracy, and strong backdoor robustness, automated deep learning techniques that integrate model neural architecture search, hyperparameter optimization, and multi-feature loss function optimization are urgently needed. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the prior art and provide a SAR image anti-backdoor classification method and system based on backdoor feature extraction optimization.

[0006] The objective of the present invention is achieved through the following technical solutions: In a first aspect, an embodiment of the present invention provides a SAR image anti-backdoor classification method based on backdoor feature extraction optimization, comprising the following steps:

[0007] S1: Construct offline poisoning training dataset, offline poisoning verification dataset and offline normal verification dataset based on the historical database of the SAR system;

[0008] S2: setting multiple first parameters to construct an optimization target for the SAR image anti-backdoor classification model;

[0009] S3: Based on the first parameter, the architecture, backdoor feature extraction position and pruning position of the SAR image anti-backdoor classification model are discretely encoded into particle positions and real number encoded into particle velocities, and an initial particle swarm Q is generated;

[0010] S4: Record the optimization rounds, calculate the fitness of all particles in Q based on the offline poisoning training dataset, offline poisoning verification dataset, and offline normal verification dataset, and perform fast non-dominated sorting;

[0011] S5: Update the dominant particle repository, calculate the global optimal particle, update the particle position and velocity, calculate the local optimal particle, and generate the next generation particle swarm Q new ;

[0012] S6: Determine whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, perform a comprehensive fitness evaluation operation on the particles in the dominant particle storage and calculate the optimal particle. Otherwise, increase the recorded optimization round by 1 and set Q new Update to Q, and repeat steps S4 to S5;

[0013] S7: Online deployment of SAR image anti-backdoor classification model based on the encoding information of optimal particles;

[0014] S8: Based on the real-time database of the SAR system, we build an online normal detection dataset and an online poisoning detection dataset, and calculate the normal sample classification accuracy and backdoor attack success rate of the online deployed model.

[0015] Furthermore, the offline poisoning training data set, offline poisoning verification data set and offline normal verification data set are constructed based on the historical database of the SAR system, specifically including:

[0016]

[0017] First, the SAR image data in the internal historical database of the SAR system is taken as the original data set and marked as O; then the image data normalization operation is performed on O to obtain the normalized data set X; wherein, the image data normalization operation consists of a segmentation operation and a scaling operation; the segmentation operation divides the SAR image in the data set into regions. When the input SAR image contains multiple classification targets, it is segmented into multiple SAR images so that each SAR image contains only a single classification target. When the input SAR image contains only a single classification target, no operation is performed; the scaling operation resizes the SAR images in the data set so that the size of each image remains consistent; secondly, the image data normalization operation is performed on the normalized data set X using formula (1) to obtain the offline data set X o ; Then, according to the ratio of 4:1, o Divide into offline training set X o_train and offline normal validation dataset X o_val Based on the poisoning rate λ, a backdoor attack strategy is randomly used to attack the offline training set X o_train The image data in the trigger is embedded, the backdoor attack strategy used at this time is recorded, and its classification label is set to 0 to obtain the offline poisoning training dataset X poison_train ; Use the same backdoor attack strategy to test the offline normal verification data set X o_val All image data in the trigger embedding and its classification label is set to 0 to obtain the offline poisoning verification dataset X poison_val .

[0018] Furthermore, the first parameters include: particle population size N, the lower limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C low , the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up , the lower limit of the number of shallow network blocks Sblock low , the upper limit of the number of shallow network blocks Sblock up , Shallow network block architecture parameter lower limit Sgenotype low , shallow network block architecture parameter upper limit Sgenotype up , the lower limit of the number of middle-layer network blocks Mblock low , the upper limit of the number of middle-layer network blocks Mblock up , the lower limit of the middle-layer network block architecture parameter Mgenotype low , the upper limit of the parameters of the middle-level network block architecture Mgenotype up , the lower limit of the number of deep network blocks Dblock low , the upper limit of the number of deep network blocks Dblock up , Deep Network Block Architecture Parameter Lower Bound Dgenotypelow , Deep Network Block Architecture Parameter Upper Limit Dgenotype up , Backdoor feature selection parameter lower limit Backdoor low , Backdoor feature selection parameter upper limit Backdoor up , Pruning position parameter lower limit low , Pruning position parameter upper limit up , the number of pruning positions g, the backdoor model training round EP backdoor , clean model training round EP clean , training learning rate lr, particle swarm evolution weight w, acceleration factor c1, acceleration factor c2, dominating particle repository size N par , adaptive grid size N ad and the maximum optimization round E max ;

[0019] The optimization objectives of the SAR image anti-backdoor classification model include: an evaluation value f1 of the SAR image anti-backdoor classification model's classification accuracy for normal samples, an evaluation value f2 of the backdoor attack success rate, and an evaluation value f3 of the number of parameters of the SAR image anti-backdoor classification model; wherein f1 and f2 are calculated according to formula (2) and formula (3), respectively, and f3 represents the number of parameters of the SAR image anti-backdoor classification model, which is obtained by directly counting the parameters of each layer of the SAR image anti-backdoor classification model and then performing a summation operation;

[0020]

[0021]

[0022] in, Represents the normal sample classification accuracy, represents the success rate of backdoor attacks, which are calculated according to formula (4) and formula (5) respectively;

[0023]

[0024]

[0025] Among them, Num clean_right Represents the number of correctly classified samples in the offline normal verification data set, Num backdoor_right Represents the number of samples classified as the set label in the offline poisoning verification dataset, Num all Represents the total number of samples in the validation set.

[0026] Furthermore, according to the first parameter, the architecture, backdoor feature extraction position and pruning position of the SAR image anti-backdoor classification model are discretely encoded as particle positions and real number encoded as particle velocities, and an initial particle swarm Q is generated. The specific implementation process is as follows:

[0027] The neural network architecture parameters, backdoor feature selection parameters and pruning position parameters of the SAR image anti-backdoor classification model are discretely encoded and used as particle position encoding Indi p ; Use the random code with the same length as the particle position code as the particle velocity code Indi v ; The encoding form of each particle is Indi=[Indi p ,Indi v ], Indi p =[C,Sblock,Sgenotype,Mblock,Mgenotype,Dblock,Dgenotype,Backdoor,Pruning],Indi v =[C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v ,Pruning v ];Indi p Represents the position information of the particle in the particle population, where C, Sblock, Sgenotype, Mblock, Mgenotype, Dblock and Dgenotype together constitute the architecture parameters of the SAR image anti-backdoor classification model. Backdoor represents the backdoor feature extraction position, and the SAR image anti-backdoor classification model is divided into the backdoor feature extraction subnetwork and the classification subnetwork. Pruning represents the model position where the pruning operation occurs; Indi v Represents the velocity information of the particle in the particle population, where C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v and Pruning vThey are all random speed parameters, and their values ​​range from the maximum particle speed Indi vmax and the minimum particle velocity Indi vmin Between; Remember Indi pmax =[C max ,Sblock max ,Sgenotype max ,Mblock max ,Mgenotype max ,Dblock max ,Dgenotype max ,Backdoor max ,Pruning max ], Indi pmin =[C min ,Sblock min ,Sgenotype min ,Mblock min ,Mgenotype min ,Dblock min ,Dgenotype min ,Backdoor min ,Pruning min ], Indi vmax and Indi vmin Calculate according to formula (6) and formula (7);

[0028] Indi vmax =(Indi pmax -Indi pmin )×0.5 (6)

[0029] Indi vmin =-Indi vmax (7)

[0030] Encoding Indi at particle positions p In the model architecture parameters, C provides the number of initial processing channels for model feature analysis, Sblock provides the number of splicing of shallow network blocks, Mblock provides the number of splicing of middle network blocks, and Dblock provides the number of splicing of deep network blocks. The above four parameters are all single integers; Sgenotype, Mgenotype and Dgenotype are all network block codes of different depths, and their encoding forms are consistent, all of which are [(n1 1 ,n2 1 ,n3 1 ,n4 1 ,n5 1 ,n6 1 ,o11 ,o2 1 ,o3 1 ,o4 1 ,o5 1 ,o6 1 ),(n1 2 ,n2 2 ,n3 2 ,n4 2 ,n5 2 ,n6 2 ,o1 2 ,o2 2 ,o3 2 ,o4 2 ,o5 2 ,o6 2 ),...,(n1 s ,n2 s ,n3 s ,n4 s ,n5 s ,n6 s ,o1 s ,o2 s ,o3 s ,o4 s ,o5 s ,o6 s )], record (n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i ,o1 i ,o2 i ,o3 i ,o4 i ,o5 i ,o6 i ) is the i-th network block, where 1≤i≤s, s is equal to the upper limit of the number of network blocks; for the i-th network block, n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i Represents the six operation nodes of this network block, o1 i ,o2 i ,o3 i ,o4 i ,o5 i ,o6 i Represents the six specific operations of the network block, where o1 i Represents n1 i Specific operation, o2 i Represents n2i The corresponding relationship between the remaining operations and nodes can be deduced by analogy; j i is the specific operation on the jth operation node in the i-th network block, where 1≤j≤6, o j i The corresponding relationship with the specific operation is: when o j i =0, set to 0; when o j i =1, perform average pooling operation; when o j i =2, perform the maximum pooling operation; when o j i =3, a convolution operation with a convolution kernel size of 7×7 is performed; when o j i =4, a convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 5, a convolution operation with a convolution kernel size of 1×1 is performed; when o j i = 6, a double-layer depth-wise separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i =7, a double-layer depth-wise separable convolution operation with a convolution kernel size of 5×5 is performed; when o j i = 8, a depth-separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 9, a depth-separable convolution operation with a convolution kernel size of 5×5 is performed; when o j i = 10, the spatially separable convolution operations with kernel sizes of 1×3 and 3×1 are performed; when o j i = 11, the spatially separable convolution operations with kernel sizes of 1×5 and 5×1 are performed; when o j i =12, no operation is performed;

[0031] The correspondence between the network block coding and network block feature calculation process is as follows: States is the set of intermediate feature values ​​of the model architecture corresponding to the current network block coding, and its initial value is States = [s1], where s1 is the intermediate feature of the model transmitted to the current network block; according to the operation nodes and specific operations in the network block coding, the feature values ​​in States are selected for calculation, and the obtained intermediate features are added to States; finally, all the intermediate features in States that have not been selected for calculation are merged as the output of the model architecture corresponding to the current network block coding;

[0032] Indi p The correspondence between the model architecture parameters and the SAR image anti-backdoor classification model architecture is as follows: the initial processing channel number provided by C is set as the initial analysis channel number of the shallow network, and the corresponding number of network block codes are extracted from the Sgenotype code according to the number of shallow network blocks provided by the Sblock code to form a shallow network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the middle network; according to the number of middle network blocks provided by the Mblock code, the corresponding number of network block codes are extracted from the Mgenotype code to form a middle network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the deep network; according to the number of deep network blocks provided by the Dblock code, the corresponding number of network block codes are extracted from the Dgenotype code to form a deep network architecture; finally, an output layer is used to calculate the output result of the current network;

[0033] Indi p The Backdoor is encoded as a single integer, which is used to provide the backdoor feature extraction position of the network. When Backdoor=0, the backdoor feature extraction position is the last layer of the shallow network. At this time, the shallow network is regarded as the backdoor feature extraction subnetwork, and the middle network and the bottom network are collectively regarded as the classification subnetwork; when Backdoor=1, the backdoor feature extraction position is the last layer of the middle network. At this time, the shallow network and the middle network are collectively regarded as the backdoor feature extraction subnetwork, and the bottom network is regarded as the classification subnetwork; when Backdoor=2, the backdoor feature extraction position is the last layer of the deep network. At this time, the shallow network, the middle network and the deep network are collectively regarded as the backdoor feature extraction subnetwork, and the classification subnetwork does not consist of network blocks, and only the final output layer is used for classification calculation;

[0034] Indi p The specific form of Pruning encoding is [Prun1, Prun2, Prun3, Prun4, ..., Prun g], is a code string consisting of {0, 1}, representing the network layer position where the pruning operation occurs; i is the i-th pruning code value, where 1≤i≤g; when Prun i = 0, it means that no pruning operation occurs at the i-th network layer position; when Prun i =1, it means that pruning operation occurs at the i-th network layer position;

[0035] Then, according to the SAR image anti-backdoor classification model, the lower limit of the number of channels C is analyzed. low , the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up , the lower limit of the number of shallow network blocks Sblock low , the upper limit of the number of shallow network blocks Sblock up , Shallow network block architecture parameter lower limit Sgenotype low , shallow network block architecture parameter upper limit Sgenotype up , the lower limit of the number of middle-layer network blocks Mblock low , the upper limit of the number of middle-layer network blocks Mblock up , the lower limit of the middle-layer network block architecture parameter Mgenotype low , the upper limit of the parameters of the middle-level network block architecture Mgenotype up , the lower limit of the number of deep network blocks Dblock low , the upper limit of the number of deep network blocks Dblock up , Deep Network Block Architecture Parameter Lower Bound Dgenotype low , Deep Network Block Architecture Parameter Upper Limit Dgenotype up , backdoor feature selection position parameter lower limit Backdoor low , Backdoor feature selection position parameter upper limit Backdoor up , Pruning position parameter lower limit low , Pruning position parameter upper limit up , generate N initial particle position codes Indi p ,Indi p The integer encoding value of is a random integer whose size is between the lower limit and upper limit of the corresponding parameter; then, according to Indi vmax and Indi vmin , generate N initial particles’ velocity codes Indi v ,Indi v The encoding value is between Indi vmax and Indi vmin Random numbers in the range; finally, N Indi pand N Indi v The combination is used as the particle encoding in the initial particle swarm Q.

[0036] Furthermore, step S4 includes the following sub-steps:

[0037] S41: Record the current optimization round. If this is the first time entering this step, the optimization round is set to 0.

[0038] S42: According to Q p The corresponding model architecture parameters generate two deep neural network models with the same architecture, one is recorded as the backdoor model and the other is recorded as the clean model; the cross entropy classification loss l is used for the backdoor model ce As the total loss of the backdoor model, the training learning rate lr is used and the Adam optimizer is used to train the offline poisoning training dataset X poison_train The model is trained with SAR image data in EP. backdoor ; l ce Calculate according to formula (8);

[0039]

[0040] Among them, θ represents all the parameters that constitute the current model, x represents the image data sample in the offline training set, and y represents the category corresponding to x, which is obtained using one-hot encoding. The implementation process of one-hot encoding is: the correct category corresponding to the image is y true ,y n is the total number of classification categories; generate a line with a length of y n The all-zero vector y one_hot ; y one_hot Middle y true The value of the position is changed to 1; one_hot That is category y true One-hot encoding of ;

[0041] In the training of the clean model, first based on Indi p The backdoor feature extraction position provided by the Backdoor parameter in the backdoor model is used to obtain the backdoor feature from the corresponding position in the backdoor model, and the backdoor feature is subjected to adaptive average pooling processing; then the feature output in training is extracted at the same position in the clean model, and the feature similarity is calculated with the backdoor feature after adaptive average pooling processing, and the calculated result l is used to obtain the backdoor feature. backdoor and the weighted cross entropy loss l of the clean model wce Combine to form the reconstruction loss l sum Used for training clean models; then use the training learning rate lr and the Adam optimizer to train the offline poisoning training dataset X poison_trainThe model is trained with SAR image data in EP. clean ; where l sum 、l wce and l backdoor Calculate according to formula (9), formula (10) and formula (11) respectively;

[0042] l sum =l wce +l backdoor (9)

[0043]

[0044]

[0045] Among them, f backdoor represents the backdoor model, f clean represents the clean model, f backdoor_ex represents the backdoor feature extraction subnetwork in the backdoor model, f clean_ex Represents the backdoor feature extraction subnetwork in the clean model. After training, based on the pruning position parameters, a pruning strategy based on the channel Lipschitz constant is used for the pruned network layers in the clean model, and the selected channel weights are reset to 0.

[0046] S43: Calculate the fitness of all particles in the particle swarm Q according to the optimization goal of the SAR image anti-backdoor classification model;

[0047] S44: After calculating the fitness of all particles, perform a fast non-dominated sorting operation; the fast non-dominated sorting measures the three fitness evaluation indicators of the particles, divides the particles into dominance groups, and obtains the particles belonging to the Pareto front in the particle group Q; among them, when the particle Indi i The three fitness evaluation indicators of the particle are all smaller than those of the other particle Indi j When the particle is called Indi i Dominant Particle Indi j ; Remember n i is the number of particles that dominate the i-th particle in the population, S i is the set of particles dominated by the i-th particle; the specific implementation process of fast non-dominated sorting is: first, let F1 be an empty set; traverse the particles in the particle group Q in turn, and calculate the n corresponding to each particle i value, and put the other particles dominated by this particle into the corresponding set S i In; i = 0 are put into the set F1; at this time, the particles in F1 are the particles belonging to the Pareto front;

[0048] Then let j1 = 1 and let H be an empty set; traverse All particles in u For The set of particles dominated by the u-th particle in , num q To dominate S u The number of particles in the qth particle; get S corresponding to each particle in u ; For all S u , traverse each S u All particles in , calculate the num corresponding to each particle q value, and let num q =num q -1; if num q =0, then S u The qth particle is put into the set H; let j1 = j1 + 1; let Repeat the above steps until you get Is an empty set.

[0049] Furthermore, step S5 includes the following sub-steps:

[0050] S51: If this is the first time to enter this step, the dominated particle repository is first cleared, and then the dominated particle repository is updated according to the particle update strategy of the dominated particle repository; the particle update strategy of the dominated particle repository is as follows: when the dominated particle repository is empty, the particles belonging to the Pareto front in the initial particle group Q are directly placed in the dominated particle repository; when the dominated particle repository is not empty, the dominated particle repository is updated according to the domination relationship, and the update strategy is as follows: when the added particle is dominated by a particle in the dominated particle repository, the particle is abandoned; when there is a particle in the dominated particle repository that is dominated by the added particle, the particle is added and all the particles dominated by it are removed; when there is no domination relationship between the added particle and the particles in the dominated particle repository, the particle is added;

[0051] When the number of particles in the dominating particle repository exceeds the maximum value N par When the particle size N is 0, some particles in the dominating particle repository are removed based on the adaptive grid method. The specific process is as follows: all particles in the current dominating particle repository are scanned, and the three particles with the largest f1 value, the largest f2 value, and the largest f3 value are taken as boundary particles; according to the location of the boundary particles and the adaptive network size N adConstruct a three-dimensional grid block. Specifically, (0,0,0), (f1,0,0), (0,f2,0), (0,0,f3), (f1,f2,0), (f1,0,f3), (0,f2,f3), (f1,f2,f3) are used as the eight vertex coordinates. Let lenth1 be the length of the first dimension grid block, lenth2 be the length of the second dimension grid block, and lenth3 be the length of the third dimension grid block. Let the grid block Net i is the i-th grid block, and its vertex coordinates are ((i-1)×lenth1, (i-1)×lenth2, (i-1)×lenth3), (i×lenth1, (i-1)×lenth2, (i-1)×l enth3), ((i-1)×lenth1,i×lenth2,(i-1)×lenth3), ((i-1)×lenth1,(i-1)×lenth2,i×lenth3), (i×len th1,i×lenth2,(i-1)×lenth3),(i×lenth1,(i-1)×lenth2,i×lenth3),((i-1)×lenth1,i×lenth2,i×lenth3),(i×lenth1,i×lenth2,i×lenth3); according to the position information of all particles in the particle repository, the number of particles in all grid blocks is counted to obtain the grid block information where particles exist; record Netnum i For Net i The number of particles in the grid block, the number of particles currently dominating the particle repository is recorded as Netnum all , then in Net i Randomly delete Netnum del Particles, Netnum del Calculate according to formula (12), where Represents a floor operation;

[0052]

[0053] S52: Calculate the global optimal particle operation: After updating the dominant particle repository, calculate the current global optimal particle Indi based on the adaptive grid method. gbest ; The specific operation is: first, according to the number of particles in the grid block, the roulette probability is assigned to the grid block, Net i Roulette probability P_Net i Calculate according to formula (13);

[0054]

[0055] According to the roulette probability of all grid blocks, a grid block is randomly selected and the global optimal particle Indi is obtained from it. gbest ; The global optimal particle selection strategy is: when the grid block contains only one particle, the particle is Indi gbest ; When the grid block contains multiple particles, one of the particles is randomly selected as the Indi gbest ;

[0056] S53: Update particle operation and calculate local optimal particle: Indi pbest is the local optimal particle corresponding to each particle in the population; if this step is entered for the first time, the local optimal particle is each particle in the population itself; let rand1 and rand2 be two random numbers between 0 and 1, and update the particle position code and particle velocity code in the population according to formula (14) and formula (15), and modify the code that exceeds the boundary value to the boundary value;

[0057] Indi vnew =w×Indi v +c1×rand1×(Indi pbest -Indi p )+c2×rand2×(Indi gbest -Indi p )(14)

[0058] Indi pnew =Indi p +Indi vnew (15)

[0059] Calculate particle index according to the optimization target of SAR image anti-backdoor classification model pnew Three fitness indicators of Indi pnew and Indi p The dominant relationship; when Indi pnew Dominate Indi p When Indi pnew is regarded as the local optimal particle of the particle; when Indi p Dominate Indi pnew When Indi p is considered as the local optimal particle of the particle; in other cases, Indi is randomly selected pnew and Indi p One of the particles is regarded as the local optimal particle;

[0060] S54: Make Indi pnew =Indi p ,Indi vnew =Indiv , complete the update operation of the particles in the particle swarm Q, and regard the new particle swarm as the new particle swarm Q new .

[0061] Furthermore, the step S6 specifically includes:

[0062] The selection operation of the optimal particle needs to first determine whether the current optimization round has reached the maximum optimization round; if the current optimization round has not reached the maximum optimization round, the recorded current optimization round will be increased by 1; if the current optimization round has reached the maximum optimization round, the fitness comprehensive evaluation operation of the particles in the dominant particle storage library will be performed to select the optimal particle; the specific selection process is: when the dominant particle storage library contains only one particle, the particle is selected as the optimal particle Indi best When the dominated particle repository contains two or more particles, the fitness comprehensive evaluation value of the i-th particle in the dominated particle repository is calculated according to formula (16): where f1 i represents the f1 fitness evaluation index of the i-th particle, f2 i represents the f2 fitness evaluation index of the i-th particle, f3 i represents the f3 fitness evaluation index of the i-th particle. The smallest particle is the optimal particle Indi best , when there are multiple particles with the minimum When selecting The particle with the higher value is regarded as the optimal particle Indi best ;

[0063]

[0064] Furthermore, the step S8 specifically includes:

[0065] Obtain real-time monitoring SAR image data from the real-time database of the SAR system, and obtain the online detection normal data set X after image data normalization and image data normalization operations. t , use the same backdoor attack strategy as in the offline poisoning training dataset to detect the normal dataset X online t All image data in the trigger embedding and its classification label is set to 0 to obtain the online poisoning detection dataset X poison_t ; For the deployed SAR image classification model, its normal sample classification accuracy and backdoor attack success rate are calculated according to formula (4) and formula (5) respectively.

[0066] A second aspect of an embodiment of the present invention provides a SAR image anti-backdoor classification system based on backdoor feature extraction and optimization, which is used to implement the above-mentioned SAR image anti-backdoor classification method based on backdoor feature extraction and optimization. The system includes:

[0067] SAR image data preprocessing module, used to construct the training data set of the SAR image anti-backdoor classification model, including offline poisoning training data set, offline poisoning verification data set, offline normal verification data set, online detection normal data set and online detection poisoning data set;

[0068] A setting module, used for setting a plurality of first parameters and an optimization target of a SAR image anti-backdoor classification model;

[0069] A particle swarm initialization module is used to perform discrete encoding of particle positions and real number encoding of particle velocities on the architecture, backdoor feature extraction position, and pruning position of the SAR image anti-backdoor classification model according to the first parameter, and generate an initial particle swarm Q;

[0070] The particle swarm fitness evaluation and non-dominated sorting module is used to record the optimization rounds, calculate the fitness of all particles in Q based on the offline poisoning training dataset, offline poisoning verification dataset, and offline normal verification dataset, and perform fast non-dominated sorting;

[0071] The new particle swarm performance evaluation and update module is used to update the dominant particle repository, calculate the global optimal particle, update the particle position and velocity, and calculate the local optimal particle to generate the next generation particle swarm Q new ;

[0072] The iterative judgment module is used to judge whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, the fitness comprehensive evaluation operation is performed on the particles in the dominant particle storage to calculate the optimal particle; otherwise, the recorded optimization round is increased by 1, and Q is new Update to Q, repeat the initial particle swarm fitness evaluation and non-dominated sorting module and the new particle swarm performance evaluation and update module;

[0073] An online deployment module for online deployment of SAR image anti-backdoor classification models based on the encoded information of the optimal particles; and

[0074] The online deployment model performance evaluation module is used to build an online detection normal data set and an online detection poisoning data set based on the real-time database of the SAR system, and calculate the normal sample classification accuracy and backdoor attack success rate of the online deployment model.

[0075] Compared with the prior art, the present invention has the following beneficial effects:

[0076] (1) The present invention comprehensively considers the classification accuracy of the SAR image classification model for normal samples, the success rate of backdoor attacks on the model, and the number of model parameters. A three-objective optimization method based on backdoor feature extraction optimization is designed. Through offline iterative optimization, an online deployment model for SAR image anti-backdoor classification is automatically obtained that takes into account the lightweight model, high accuracy, and strong backdoor robustness.

[0077] (2) The present invention not only realizes the automated optimization design and automated generation of the optimal deep neural network model with compromised multiple performance indicators for the SAR image classification system, but also the constructed backdoor feature extraction subnetwork expands the processing method of backdoor features in the SAR image classification model. While improving the classification accuracy and backdoor robustness of the model, it also greatly reduces the number of model parameters, better realizes the lightweight of the model, and is more convenient for the online deployment and engineering implementation of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 This is a flow chart of the SAR image anti-backdoor classification method based on backdoor feature extraction optimization;

[0079] Figure 2 It is a schematic diagram of the depth-wise separable convolution operation, where the convolution kernel size is n×n;

[0080] Figure 3 It is a schematic diagram of a two-layer depth-wise separable convolution operation with a convolution kernel size of n×n;

[0081] Figure 4 It is a schematic diagram of the spatially separable convolution operation with kernel sizes of 1×n and n×1;

[0082] Figure 5 is an example diagram of a single particle encoding;

[0083] Figure 6 It is the global optimal particle Indi participating in the particle update operation of the particle swarm gbest Example diagram of ;

[0084] Figure 7 is used Figure 6 The global optimal particle Indi gbest right Figure 5 Example diagram of updating the particles in ;

[0085] Figure 8 is the Pareto front that dominates the particles in the particle repository after 20 optimizations;

[0086] Figure 9This figure compares the classification accuracy of normal samples of the classification model generated by the present invention, the Resnet18 classification model without backdoor defense strategy, and the classification model using causality-inspired Backdoor Defense (CBD) technology after four backdoor attacks on the UCMerced-LandUse dataset. The four backdoor attacks are the Badnets attack based on visible triggers, the Blend attack based on invisible triggers, the SIG attack based on clean labels, and the WaNet attack based on distortion.

[0087] Figure 10 The comparison results of the backdoor attack success rates of the classification model generated by the present invention, the Resnet18 classification model without backdoor defense strategy, and the classification model using the CBD backdoor defense strategy on the UCMerced-LandUse dataset for four types of backdoor attacks;

[0088] Figure 11 The comparison results of the number of parameters of the classification model generated by the present invention, the Resnet18 classification model without backdoor defense strategy, and the classification model using CBD backdoor defense strategy;

[0089] Figure 12 This is a structural diagram of a SAR image anti-backdoor classification system based on backdoor feature extraction and optimization. DETAILED DESCRIPTION

[0090] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0091] See also Figure 1 The SAR image anti-backdoor classification method based on backdoor feature extraction and optimization of the present invention specifically includes the following steps:

[0092] S1: Based on the historical database of the SAR system, an offline poisoning training dataset, an offline poisoning verification dataset, and an offline normal verification dataset are constructed.

[0093] In this embodiment, an offline poisoning training dataset, an offline poisoning verification dataset, and an offline normal verification dataset are constructed based on the historical database of the SAR system. Specifically, the following steps are performed: first, the SAR image data in the internal historical database of the SAR system is used as the original dataset and marked as O; then, an image data normalization operation is performed on O to obtain a normalized dataset X; wherein, the image data normalization operation consists of a segmentation operation and a scaling operation; the segmentation operation divides the SAR image in the dataset into regions. When the input SAR image contains multiple classified targets, it is segmented into multiple SAR images so that each SAR image contains only a single classified target. When the input SAR image contains only a single classified target, no operation is performed; the scaling operation resizes the SAR images in the dataset so that the size of each image remains consistent; secondly, the image data normalization operation is performed on the normalized dataset X using formula (1) to obtain the offline dataset X o ; Then, according to the ratio of 4:1, o Divide into offline training set X o_train and offline normal validation dataset X o_val Based on the poisoning rate λ, a backdoor attack strategy is randomly used to attack the offline training set X o_train The image data in the trigger is embedded, the backdoor attack strategy used at this time is recorded, and its classification label is set to 0 to obtain the offline poisoning training dataset X poison_train ; Use the same backdoor attack strategy to test the offline normal verification data set X o_val All image data in the trigger embedding and its classification label is set to 0 to obtain the offline poisoning verification dataset X poison_val .

[0094]

[0095] It should be noted that, in this embodiment, the UCMerced-LandUse image dataset is used as the simulated SAR system historical dataset, and the backdoor attack strategies that can be randomly selected include: Badnets attack, Blend attack, and SIG attack.

[0096] S2: Set multiple first parameters to construct an optimization target for the SAR image anti-backdoor classification model.

[0097] In this embodiment, the first parameters include the particle population size N=30, the lower limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C low =4, the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up =8, the lower limit of the number of shallow network blocks Sblock low =1, upper limit of shallow network blocks Sblock up=3, shallow network block architecture parameter lower limit Sgenotype low =[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0], shallow network block architecture parameter upper limit Sgenotype up =[0,1,2,3,4,5,12,12,12,12,12,12,0,1,2,3,4,5,12,12,12,12,12,12,0,1,2,3,4,5,12,12,12,12,12,12], the lower limit of the number of middle-layer network blocks Mblock low =1, the upper limit of the number of middle-layer network blocks Mblock up =3, the lower limit of the middle-layer network block architecture parameter Mgenotype low =[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0], the upper limit of the middle-layer network block architecture parameter Mgenotype up =[0,1,2,3,4,5,12,12,12,12,12,12,0,1,2,3,4,5,12,12,12,12,12,12,0,1,2,3,4,5,12,12,12,12,12,12], the lower limit of the number of deep network blocks Dblock low =1, upper limit of deep network blocks Dblock up =2, the lower limit of the deep network block architecture parameter Dgenotype low =[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0], upper limit of deep network block architecture parameters Dgenotype up =[0,1,2,3,4,5,12,12,12,12,12,12,0,1,2,3,4,5,12,12,12,12,12,12], the lower limit of the backdoor feature selection parameter Backdoor low =0, the upper limit of the backdoor feature selection parameter Backdoor up =2, pruning position parameter lower limit Pruning low=[0, ... up =[1, ...], number of pruning positions g = 100, number of backdoor model training rounds EP backdoor =5, clean model training round EP clean =20, training learning rate lr = 0.001, particle swarm evolution weight w = 0.8, acceleration factor c1 = 2.0, acceleration factor c2 = 2.0, and the size of the dominant particle repository N par =200, adaptive grid size N ad =20, maximum optimization round E max =20.

[0098] In this embodiment, the optimization objectives of the SAR image anti-backdoor classification model include: an evaluation value f1 of the SAR image anti-backdoor classification model's classification accuracy for normal samples, an evaluation value f2 of the backdoor attack success rate, and an evaluation value f3 of the number of parameters of the SAR image anti-backdoor classification model; wherein f1 and f2 can be calculated according to formula (2) and formula (3), respectively, and f3 represents the number of parameters of the SAR image anti-backdoor classification model, which can be obtained by directly counting the parameters of each layer of the SAR image anti-backdoor classification model and then performing a summation operation;

[0099]

[0100]

[0101] in, Represents the normal sample classification accuracy, represents the success rate of backdoor attacks, which are calculated according to formula (4) and formula (5) respectively.

[0102]

[0103]

[0104] Among them, Num clean_right Represents the number of correctly classified samples in the offline normal verification data set, Num backdoor_right Represents the number of samples classified as the set label in the offline poisoning verification dataset, Num all Represents the total number of samples in the validation set.

[0105] It should be noted that the above first parameter can be set according to actual conditions.

[0106] S3: According to the first parameter, the architecture, backdoor feature extraction position and pruning position of the SAR image anti-backdoor classification model are discretely encoded as particle positions and real number encoded as particle velocities, and an initial particle swarm Q is generated.

[0107] In this embodiment, according to the first parameter, the architecture, backdoor feature extraction position and pruning position of the SAR image anti-backdoor classification model are discretely encoded into particle positions and real-number encoded into particle velocities, and an initial particle swarm Q is generated. The specific implementation process is as follows:

[0108] The neural network architecture parameters, backdoor feature selection parameters and pruning position parameters of the SAR image anti-backdoor classification model are discretely encoded and used as particle position encoding Indi p ; Use the random code with the same length as the particle position code as the particle velocity code Indi v ; The encoding form of each particle is Indi=[Indi p ,Indi v ], Indi p =[C,Sblock,Sgenotype,Mblock,Mgenotype,Dblock,Dgenotype,Backdoor,Pruning],Indi v =[C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v ,Pruning v ];Indi pRepresents the position information of the particle in the particle population, where C, Sblock, Sgenotype, Mblock, Mgenotype, Dblock and Dgenotype together constitute the architecture parameters of the SAR image anti-backdoor classification model. Backdoor represents the backdoor feature extraction position, and the SAR image anti-backdoor classification model is divided into the backdoor feature extraction subnetwork and the classification subnetwork. Pruning represents the model position where the pruning operation occurs; Indi v Represents the velocity information of the particle in the particle population, where C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v and Pruning v They are all random speed parameters, and their values ​​range from the maximum particle speed Indi vmax and the minimum particle velocity Indi vmin Between; Remember Indi pmax =[C max ,Sblock max ,Sgenotype max ,Mblock max ,Mgenotype max ,Dblock max ,Dgenotype max ,Backdoor max ,Pruning max ], Indi pmin =[C min ,Sblock min ,Sgenotype min ,Mblock min ,Mgenotype min ,Dblock min ,Dgenotype min ,Backdoor min ,Pruning min ], Indi vmax and Indi vmin Calculate according to formula (6) and formula (7);

[0109] Indi vmax =(Indi pmax -Indi pmin)×0.5 (6)

[0110] Indi vmin =-Indi vmax (7)

[0111] Encoding Indi at particle positions p In the model architecture parameters, C provides the number of initial processing channels for model feature analysis, Sblock provides the number of splicing of shallow network blocks, Mblock provides the number of splicing of middle network blocks, and Dblock provides the number of splicing of deep network blocks. The above four parameters are all single integers; Sgenotype, Mgenotype and Dgenotype are all network block codes of different depths, and their encoding forms are consistent, all of which are [(n1 1 ,n2 1 ,n3 1 ,n4 1 ,n5 1 ,n6 1 ,o1 1 ,o2 1 ,o3 1 ,o4 1 ,o5 1 ,o6 1 ),(n1 2 ,n2 2 ,n3 2 ,n4 2 ,n5 2 ,n6 2 ,o1 2 ,o2 2 ,o3 2 ,o4 2 ,o5 2 ,o6 2 ),...,(n1 s ,n2 s ,n3 s ,n4 s ,n5 s ,n6 s ,o1 s ,o2 s ,o3 s ,o4 s ,o5 s ,o6 s )], record (n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i ,o1 i ,o2 i ,o3i ,o4 i ,o5 i ,o6 i ) is the i-th network block, where 1≤i≤s, s is equal to the upper limit of the number of network blocks; for the i-th network block, n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i Represents the six operation nodes of this network block, o1 i ,o2 i ,o3 i ,o4 i ,o5 i ,o6 i Represents the six specific operations of the network block, where o1 i Represents n1 i Specific operation, o2 i Represents n2 i The corresponding relationship between the remaining operations and nodes can be deduced by analogy; j i is the specific operation on the jth operation node in the i-th network block, where 1≤j≤6, o j i The corresponding relationship with the specific operation is: when o j i =0, set to 0; when o j i =1, perform average pooling operation; when o j i =2, perform the maximum pooling operation; when o j i =3, a convolution operation with a convolution kernel size of 7×7 is performed; when o j i =4, a convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 5, a convolution operation with a convolution kernel size of 1×1 is performed; when o j i = 6, a double-layer depth-wise separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i =7, a double-layer depth-wise separable convolution operation with a convolution kernel size of 5×5 is performed; when o j i = 8, a depth-separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 9, a depth-separable convolution operation with a convolution kernel size of 5×5 is performed; when oj i = 10, the spatially separable convolution operations with kernel sizes of 1×3 and 3×1 are performed; when o j i = 11, the spatially separable convolution operations with kernel sizes of 1×5 and 5×1 are performed; when o j i =12, no operation is performed; Figure 2 A schematic diagram of the depth-wise separable convolution operation is given; Figure 3 A schematic diagram of a two-layer depthwise separable convolution operation is given; Figure 4 A schematic diagram of the spatially separable convolution operation is given.

[0112] The correspondence between the network block coding and the network block feature calculation process is as follows: let States be the set of intermediate feature values ​​of the model architecture corresponding to the current network block coding, and its initial value is States = [s1], where s1 is the intermediate feature of the model transmitted to the current network block; according to the operation nodes and specific operations in the network block coding, the feature values ​​in States are selected for calculation, and the obtained intermediate features are added to States; finally, all the intermediate features in States that have not been selected for calculation are merged as the output of the model architecture corresponding to the current network block coding.

[0113] Indi p The correspondence between the model architecture parameters and the SAR image anti-backdoor classification model architecture is as follows: the initial processing channel number provided by C is set as the initial analysis channel number of the shallow network, and the corresponding number of network block codes are extracted from the Sgenotype code according to the number of shallow network blocks provided by the Sblock code to form a shallow network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the middle network; according to the number of middle network blocks provided by the Mblock code, the corresponding number of network block codes are extracted from the Mgenotype code to form a middle network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the deep network; according to the number of deep network blocks provided by the Dblock code, the corresponding number of network block codes are extracted from the Dgenotype code to form a deep network architecture; finally, an output layer is used to calculate the output result of the current network.

[0114] Indi pThe Backdoor is encoded as a single integer, which is used to provide the backdoor feature extraction position of the network. When Backdoor=0, the backdoor feature extraction position is the last layer of the shallow network. At this time, the shallow network is regarded as the backdoor feature extraction subnetwork, and the middle network and the bottom network are collectively regarded as the classification subnetwork; when Backdoor=1, the backdoor feature extraction position is the last layer of the middle network. At this time, the shallow network and the middle network are collectively regarded as the backdoor feature extraction subnetwork, and the bottom network is regarded as the classification subnetwork; when Backdoor=2, the backdoor feature extraction position is the last layer of the deep network. At this time, the shallow network, the middle network and the deep network are collectively regarded as the backdoor feature extraction subnetwork, and the classification subnetwork does not consist of network blocks, and only the final output layer is used for classification calculation.

[0115] Indi p The specific form of Pruning encoding is [Prun1, Prun2, Prun3, Prun4, ..., Prun g ], is a code string consisting of {0, 1}, representing the network layer position where the pruning operation occurs; i is the i-th pruning code value, where 1≤i≤g; when Prun i = 0, it means that no pruning operation occurs at the i-th network layer position; when Prun i =1, it means that pruning operation occurs at the i-th network layer position.

[0116] For example, in this embodiment, the encoding of a particle is as follows Figure 5Its position encoding information is as follows: [2,3,0,0,1,2,4,4,2,4,4,8,9,12,0,1,2,3,2,3,5,5,1,0,11,6,0,1,1,1,0,4,2,11,8,9,7,7,2,0,1,2,2,2,5,8,8,4,9,3,7,0,1,2, 0,4,5,1,1,2,0,7,8,0,0,0,1,4,5,2,8,9,11,10,2,1,0,1,1,3,3,5,0,0,2,5,7,7,0,1,2,3,3,5,10,5,3,4,8,6,1,0,0,0,0,1,0,1,1,1,0,0,1,0,1, 1,1,1,1,0,0,1,1,0,1,1,1,1,0,1,1,1,1,1,0,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1,0,1,1,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,1,1,1,0,1,1,1,1,0,1,1,0,1,1,1,1,0,1,1,0,1,1,1,0,1,0,1,1,1,1,0,1,0,0,1,1,1,1,0], where [2] is the number of starting analysis channels, [3] is the number of shallow network blocks, [0,0,1,2,4,4,2,4,4,8,9,12,0,1,2,3,2,3,5,5,1,0,11,6, ,8,9,7,7] are shallow network block architecture parameters, [2] is the number of middle network blocks, [0,1,2,2,2,5,8,8,4,9,3,7,0,1,2,0,4,5,1,1,2,0,7,8,0,0,0,1,4,5,2,8,9,11,10,2] are middle network block architecture parameters, [1] is the number of deep network blocks, [0,1,1,3,3,5,0,0,2,5,7,7,0,1,2,3,3,5,10,5,3,4,8,6] are deep network block architecture parameters, [1] is the backdoor feature extraction parameter, [0,0,0,0,1,0,1,1,1,0,0,1,1 ,1,1,1,0,0,1,1,0,1,1,1,1,0,1,1,1,1,0,1,1,1,1,1,0,0,1,1,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,1,1,1,1,0,1,1,1,1,1,0,1,1,1,1,1,0,1, 1,0,1,0,1,1,0,0,1,0,1,1,1,0,1,0,0,0,1,1,1,1,0] is the pruning position parameter; its speed encoding information is: [0.5,-0.1,0.0,-0.3,0.9,-0.0,0.6,-2.1,-1.7,3.0,-3.5,1.3,4.6,-4.4,0.0,0.1,-0.4,1.2,0.9,-2.3,2.8,2.7,-2.1,3.7,0.3,-0.2,0.0,-0.3,-0.0,-1.0,-1.0,0.3,3.9,3.7,-2.5,-1.8,-3.9,-2.9,-0.8,0.0,-0.4,-0.5,1.3,0.9,2.0,-1.4,-1.3,0.5,4.5,-0.2,-3.4,0.0,0.5,0.2,-0.1,-0.3,0.7,2.9,-1.8,-2.3,-1. 3,-2.6,5.5,0.0,0.2,0.4,0.7,-0.5,0.5,-1.4,5.7,-5.7,-2.9,-1.6,-0.8,-0.1,0.0,0.3,0.6,0.5,0.8,1.9,0.8,-4.2,4.4,-1.6,4.7,2.6,0.0,0.3,0.3,-0.6,-1.2,0.7,-3.5,-4.3,-3.1,-2.5,4.4,2.7,-0.4,-0.1,0.1,-0.5,-0.3,-0.4,0.1,0.4,- 0.4,-0.4,0.2,0.0,-0.4,0.4,0.1,-0.3,-0.3,0.2,0.4,-0.4,-0.5,-0.5,0.1,0.2,-0.3,0.4,-0.2,0.4,0.4,-0.4,-0.1,0.5,0.5,-0.4,0.4,-0.5,-0.1,0.3,-0.0,-0.2,-0.0,-0.3,-0.4,-0.3,-0.5,0.4,-0.1,-0.2,-0.2,0.3,0.5,-0.3,0.3,-0.1,0. 3,-0.2,-0.1,0.0,-0.1,-0.3,0.4,-0.3,-0.2,-0.3,-0.4,0.2,-0.3,0.0,0.4,0.2,-0.0,-0.3,0.4,0.1,-0.2,0.0,-0.2,-0.4,-0.0,-0.1,0.0,-0.4,-0.1,-0.4,0.2,0.2,-0.2,0.4,0.3,-0.4,-0.3,0.1,0.4,0.2,-0.4,-0.4,0.2,0.5,-0.1,0.2,-0.5].

[0117] Then, according to the SAR image anti-backdoor classification model, the lower limit of the number of channels C is analyzed. low , the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up , the lower limit of the number of shallow network blocks Sblock low , the upper limit of the number of shallow network blocks Sblockup , Shallow network block architecture parameter lower limit Sgenotype low , shallow network block architecture parameter upper limit Sgenotype up , the lower limit of the number of middle-layer network blocks Mblock low , the upper limit of the number of middle-layer network blocks Mblock up , the lower limit of the middle-layer network block architecture parameter Mgenotype low , the upper limit of the parameters of the middle-level network block architecture Mgenotype up , the lower limit of the number of deep network blocks Dblock low , the upper limit of the number of deep network blocks Dblock up , Deep Network Block Architecture Parameter Lower Bound Dgenotype low , Deep Network Block Architecture Parameter Upper Limit Dgenotype up , backdoor feature selection position parameter lower limit Backdoor low , Backdoor feature selection position parameter upper limit Backdoor up , Pruning position parameter lower limit low , Pruning position parameter upper limit up , generate N initial particle position codes Indi p ,Indi p The integer encoding value of is a random integer whose size is between the lower limit and upper limit of the corresponding parameter; then, according to Indi vmax and Indi vmin , generate N initial particles’ velocity codes Indi v ,Indi v The encoding value is between Indi vmax and Indi vmin Random numbers in the range; finally, N Indi p and N Indi v The combination is used as the particle encoding in the initial particle swarm Q.

[0118] S4: Record the optimization rounds, calculate the fitness of all particles in Q based on the offline poisoning training dataset, offline poisoning verification dataset, and offline normal verification dataset, and perform fast non-dominated sorting.

[0119] S41: Record the current optimization round. If this is the first time entering this step, the optimization round is set to 0.

[0120] S42: According to Q pThe corresponding model architecture parameters generate two deep neural network models with the same architecture, one is recorded as the backdoor model and the other is recorded as the clean model; the cross entropy classification loss l is used for the backdoor model ce As the total loss of the backdoor model, the training learning rate lr is used and the Adam optimizer is used to train the offline poisoning training dataset X poison_train The model is trained with SAR image data in EP. backdoor ; l ce Calculate according to formula (8).

[0121]

[0122] Among them, θ represents all the parameters that constitute the current model, x represents the image data sample in the offline training set, and y represents the category corresponding to x, which is obtained using One-Hot Encoding. The implementation process of One-Hot Encoding is: the correct category corresponding to the image is y true ,y n is the total number of classification categories; generate a line with a length of y n The all-zero vector y one_hot ; y one_hot Middle y true The value of the position is changed to 1; one_hot That is category y true One-hot encoding of .

[0123] In the training of the clean model, first based on Indi p The backdoor feature extraction position provided by the Backdoor parameter in the backdoor model is used to obtain the backdoor feature from the corresponding position in the backdoor model, and the backdoor feature is subjected to adaptive average pooling processing; then the feature output in training is extracted at the same position in the clean model, and the feature similarity is calculated with the backdoor feature after adaptive average pooling processing, and the calculated result l is used to obtain the backdoor feature. backdoor and the weighted cross entropy loss l of the clean model wce Combine to form the reconstruction loss l sum Used for training clean models; then use the training learning rate lr and the Adam optimizer to train the offline poisoning training dataset X poison_train The model is trained with SAR image data in EP. clean ; where l sum 、l wce and l backdoor Calculate according to formula (9), formula (10) and formula (11) respectively.

[0124] l sum =l wce +l backdoor (9)

[0125]

[0126]

[0127] Among them, f backdoor represents the backdoor model, f clean represents the clean model, f backdoor_ex represents the backdoor feature extraction subnetwork in the backdoor model, f clean_ex Represents the backdoor feature extraction subnetwork in the clean model. After training, based on the pruning position parameters, a Channel Lipschitzness-based Pruning (CLP) strategy is applied to the pruned network layers in the clean model, resetting the weights of the selected channels to 0.

[0128] S43: Calculate the fitness of all particles in the particle swarm Q according to the optimization objective of the SAR image anti-backdoor classification model.

[0129] S44: After calculating the fitness of all particles, perform a fast non-dominated sorting operation; the fast non-dominated sorting measures the three fitness evaluation indicators of the particles, divides the particles into dominance groups, and obtains the particles belonging to the Pareto front in the particle group Q; among them, when the particle Indi i The three fitness evaluation indicators of the particle are all smaller than those of the other particle Indi j When the particle is called Indi i Dominant Particle Indi j ; Remember n i is the number of particles that dominate the i-th particle in the population, S i is the set of particles dominated by the i-th particle; the specific implementation process of fast non-dominated sorting is: first, let F1 be an empty set; traverse the particles in the particle group Q in turn, and calculate the n corresponding to each particle i value, and put the other particles dominated by this particle into the corresponding set S i In; i = 0 are put into the set F1; at this time, the particles in F1 are the particles belonging to the Pareto front.

[0130] Then let j1 = 1 and let H be an empty set; traverse All particles in u For The set of particles dominated by the u-th particle in , num q To dominate S u The number of particles in the qth particle; get S corresponding to each particle in u ; For all S u, traverse each S u All particles in , calculate the num corresponding to each particle q value, and let num q =num q -1; if num q =0, then S u The qth particle is put into the set H; let j1 = j1 + 1; let Repeat the above steps until you get Is an empty set.

[0131] S5: Update the dominant particle repository, calculate the global optimal particle, update the particle position and velocity, calculate the local optimal particle, and generate the next generation particle swarm Q new .

[0132] S51: If this is the first time to enter this step, the dominating particle repository is first cleared, and then the dominating particle repository is updated according to the particle update strategy of the dominating particle repository; the particle update strategy of the dominating particle repository is: when the dominating particle repository is empty, the particles belonging to the Pareto front in the initial particle group Q are directly placed in the dominating particle repository; when the dominating particle repository is not empty, the dominating particle repository is updated according to the domination relationship, and the update strategy is: when the added particle is dominated by a particle in the dominating particle repository, the particle is abandoned; when there is a particle in the dominating particle repository that is dominated by the added particle, the particle is added and all the particles dominated by it are removed; when there is no domination relationship between the added particle and the particles in the dominating particle repository, the particle is added.

[0133] When the number of particles in the dominating particle repository exceeds the maximum value N par When the particle size N is 0, some particles in the dominating particle repository are removed based on the adaptive grid method. The specific process is as follows: all particles in the current dominating particle repository are scanned, and the three particles with the largest f1 value, the largest f2 value, and the largest f3 value are taken as boundary particles; according to the location of the boundary particles and the adaptive network size N ad Construct a three-dimensional grid block. Specifically, (0,0,0), (f1,0,0), (0,f2,0), (0,0,f3), (f1,f2,0), (f1,0,f3), (0,f2,f3), (f1,f2,f3) are used as the eight vertex coordinates. Let lenth1 be the length of the first dimension grid block, lenth2 be the length of the second dimension grid block, and lenth3 be the length of the third dimension grid block. Let the grid block Net iis the i-th grid block, and its vertex coordinates are ((i-1)×lenth1, (i-1)×lenth2, (i-1)×lenth3), (i×lenth1, (i-1)×lenth2, (i-1)×l enth3), ((i-1)×lenth1,i×lenth2,(i-1)×lenth3), ((i-1)×lenth1,(i-1)×lenth2,i×lenth3), (i×len th1,i×lenth2,(i-1)×lenth3),(i×lenth1,(i-1)×lenth2,i×lenth3),((i-1)×lenth1,i×lenth2,i×lenth3),(i×lenth1,i×lenth2,i×lenth3); according to the position information of all particles in the particle repository, the number of particles in all grid blocks is counted to obtain the grid block information where particles exist; record Netnum i For Net i The number of particles in the grid block, the number of particles currently dominating the particle repository is recorded as Netnum all , then in Net i Randomly delete Netnum del Particles, Netnum del Calculate according to formula (12), where Represents a floor operation.

[0134]

[0135] S52: Calculate the global optimal particle operation: After updating the dominant particle repository, calculate the current global optimal particle Indi based on the adaptive grid method. gbest ; The specific operation is: first, according to the number of particles in the grid block, the roulette probability is assigned to the grid block, Net i Roulette probability P_Net i Calculate according to formula (13).

[0136]

[0137] Then, according to the roulette probability of all grid blocks, a grid block is randomly selected to obtain the global optimal particle Indi gbest ; The global optimal particle selection strategy is: when the grid block contains only one particle, the particle is Indi gbest ; When the grid block contains multiple particles, one of the particles is randomly selected as the Indi gbest .

[0138] S53: Update particle operation and calculate local optimal particle: Indi pbest is the local optimal particle corresponding to each particle in the population; if this step is entered for the first time, the local optimal particle is each particle in the population itself; let rand1 and rand2 be two random numbers between 0 and 1, and update the particle position code and particle velocity code in the population according to formula (14) and formula (15), and modify the code that exceeds the boundary value to the boundary value.

[0139] Indi vnew =w×Indi v +c1×rand1×(Indi pbest -Indi p )+c2×rand2×(Indi gbest -Indi p )(14)

[0140] Indi pnew =Indi p +Indi vnew (15)

[0141] Calculate particle index according to the optimization target of SAR image anti-backdoor classification model pnew Three fitness indicators of Indi pnew and Indi p The dominant relationship; when Indi pnew Dominate Indi p When Indi pnew is regarded as the local optimal particle of the particle; when Indi p Dominate Indi pnew When Indi p is considered as the local optimal particle of the particle; in other cases, Indi is randomly selected pnew and Indi p One of the particles in is taken as the local optimal particle.

[0142] S54: Make Indi pnew =Indi p ,Indi vnew =Indi v , complete the update operation of the particles in the particle swarm Q, and regard the new particle swarm as the new particle swarm Q new .

[0143] For example, in this embodiment, the process of particle swarm particle update operation is as follows: Figure 6 and Figure 7 As shown, Figure 6 The global optimal particle Indi participating in the update is givengbest Example, Figure 7 Use the global optimal particle pair Figure 5 The particles in the update are calculated. Figure 5 The particle Indi is regarded as the local optimal particle Indi pbest , where the values ​​of the random calculation parameters are: random parameter rand1 = 0.2, random parameter rand2 = 0.6.

[0144] S6: Determine whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, perform a comprehensive fitness evaluation operation on the particles in the dominant particle storage and calculate the optimal particle. Otherwise, increase the recorded optimization round by 1 and set Q new Update to Q and repeat steps S4 to S5.

[0145] Specifically, the selection operation of the optimal particle needs to first determine whether the current optimization round has reached the maximum optimization round; if the current optimization round has not reached the maximum optimization round, the recorded current optimization round is increased by 1; if the current optimization round has reached the maximum optimization round, the fitness comprehensive evaluation operation is performed on the particles in the dominant particle repository to select the optimal particle; the specific selection process is: when the dominant particle repository contains only one particle, the particle is selected as the optimal particle Indi best When the dominated particle repository contains two or more particles, the fitness comprehensive evaluation value of the i-th particle in the dominated particle repository is calculated according to formula (16): where f1 i represents the f1 fitness evaluation index of the i-th particle, f2 i represents the f2 fitness evaluation index of the i-th particle, f3 i represents the f3 fitness evaluation index of the i-th particle. The smallest particle is the optimal particle Indi best , when there are multiple particles with the minimum When selecting The particle with the higher value is regarded as the optimal particle Indi best .

[0146]

[0147] In this embodiment, after 20 optimizations, the Pareto front of the particles in the particle storage is as follows: Figure 8 shown.

[0148] S7: Online deployment of SAR image anti-backdoor classification model based on the encoding information of optimal particles.

[0149] Specifically, after obtaining the optimal particle, the SAR image classification model is deployed online for online detection based on the encoding information of the optimal particle.

[0150] S8: Based on the real-time database of the SAR system, we build an online normal detection dataset and an online poisoning detection dataset, and calculate the normal sample classification accuracy and backdoor attack success rate of the online deployed model.

[0151] Specifically, the real-time monitoring SAR image data is obtained from the real-time database of the SAR system, and the online detection normal data set X is obtained after image data normalization and image data normalization operations. t , use the same backdoor attack strategy as in the offline poisoning training dataset to detect the normal dataset X online t All image data in the trigger embedding and its classification label is set to 0 to obtain the online poisoning detection dataset X poison_t ; For the deployed SAR image classification model, its normal sample classification accuracy and backdoor attack success rate are calculated according to formula (4) and formula (5) respectively.

[0152] In this embodiment, the SAR image classification model deployed by the technology of the present invention is experimentally tested and compared with the existing causality-inspired Backdoor Defense (CBD) technology. In the experiment, the Resnet18 model was selected as the basic SAR image classification model. Without adding a backdoor defense strategy, the attack effects of four types of backdoor attack technologies on the SAR image classification model were tested. These four types of backdoor attack technologies are specifically: Badnets attack, Blend attack, SIG attack and WaNet attack. Then, the defense capability and classification effect of the SAR image classification model obtained by using the CBD backdoor defense technology against these four types of backdoor attack technologies were tested. Finally, the defense capability and classification effect of the SAR image classification model obtained by using the backdoor defense strategy of the present invention against these four types of backdoor attack technologies were tested. For the Resnet18 classification model without a defense strategy, the classification model using the CBD defense method and the classification model generated by the present invention, the classification accuracy of the model for normal samples after the backdoor attack, the attack success rate of the four types of backdoor attacks and the number of parameters of the model are statistically analyzed for comparison. The comparison results of the normal sample classification accuracy are shown in the figure below. Figure 9 As shown in the figure, the comparison results of the success rate of backdoor attacks are as follows: Figure 10 As shown in the figure, the comparison results of the number of model parameters are as follows Figure 11As shown in the figure, it is not difficult to find that the success rate of the four types of backdoor attacks on the classification model generated by the present invention is much lower than that of the Resnet18 model without a defense strategy and the model based on the CBD defense method. In other words, the four types of backdoor attack techniques are unlikely to mislead the classification model of the present invention. At the same time, the classification accuracy of normal samples in the present invention is at the same level as that of the Resnet18 model without a defense strategy. In addition, the number of parameters of the SAR image classification model automatically generated by the present invention is the smallest, that is, the model generated by the present invention is more lightweight.

[0153] In summary, the SAR image anti-backdoor classification method based on backdoor feature extraction optimization described in the present invention not only realizes the automatic generation of a SAR image classification model that takes into account multiple performance indicators, but the constructed backdoor feature extraction subnetwork also expands the processing method of backdoor features in the SAR image classification model; by combining formula (1) to formula (16) with steps S1 to S8 of the present invention, the two performance indicators (normal sample classification accuracy and backdoor attack success rate) and the number of model parameters finally obtained perform better in terms of comprehensive performance.

[0154] It is worth mentioning that the present invention also provides a SAR image anti-backdoor classification system based on backdoor feature extraction and optimization, which is used to implement the SAR image anti-backdoor classification method based on backdoor feature extraction and optimization in the above embodiment.

[0155] See also Figure 12 The system includes a SAR image data preprocessing module 10, a setting module 20, a particle swarm initialization module 30, a particle swarm fitness evaluation and non-dominated sorting module 40, a new particle swarm performance evaluation and update module 50, an iterative judgment module 60, an online deployment module 70 and an online deployment model performance evaluation module 80.

[0156] In this embodiment, the SAR image data preprocessing module 10 is used to construct a training data set for the SAR image anti-backdoor classification model, including an offline poisoning training data set, an offline poisoning verification data set, an offline normal verification data set, an online detection normal data set, and an online detection poisoning data set.

[0157] In this embodiment, the setting module 20 is used to set a plurality of first parameters and an optimization target of the SAR image anti-backdoor classification model.

[0158] In this embodiment, the particle swarm initialization module 30 is used to perform discrete encoding of particle positions and real number encoding of particle velocities on the architecture, backdoor feature extraction position, and pruning position of the SAR image anti-backdoor classification model according to the first parameter, and generate an initial particle swarm Q.

[0159] In this embodiment, the particle swarm fitness evaluation and non-dominated sorting module 40 is used to record the optimization rounds, calculate the fitness of all particles in Q based on the offline poisoning training data set, the offline poisoning verification data set and the offline normal verification data set, and perform fast non-dominated sorting.

[0160] In this embodiment, the new particle swarm performance evaluation and update module 50 is used to update the dominant particle repository, calculate the global optimal particle, update the position and velocity of the particle, and calculate the local optimal particle to generate the next generation particle swarm Q new .

[0161] In this embodiment, the iterative judgment module 60 is used to judge whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, the fitness comprehensive evaluation operation is performed on the particles in the dominant particle storage to calculate the optimal particle; otherwise, the recorded optimization round is increased by 1, and Q is increased by 1. new Update to Q, repeat the initial particle swarm fitness evaluation and non-dominated sorting module and the new particle swarm performance evaluation and update module.

[0162] In this embodiment, the online deployment module 70 is used to deploy the SAR image anti-backdoor classification model online based on the encoding information of the optimal particles.

[0163] In this embodiment, the online deployment model performance evaluation module 80 is used to construct an online detection normal data set and an online detection poisoning data set based on the real-time database of the SAR system, and calculate the normal sample classification accuracy and backdoor attack success rate of the deployed model.

[0164] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc. Various media that can store program codes.

[0165] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A SAR image anti-backdoor classification method based on backdoor feature extraction and optimization, characterized in that: The following steps are involved: S1: Construct offline poisoning training dataset, offline poisoning verification dataset and offline normal verification dataset based on the historical database of the SAR system; S2: setting multiple first parameters to construct an optimization target for the SAR image anti-backdoor classification model; S3: Based on the first parameter, the architecture, backdoor feature extraction position and pruning position of the SAR image anti-backdoor classification model are discretely encoded into particle positions and real number encoded into particle velocities, and an initial particle swarm Q is generated; S4: Record the optimization rounds and generate two deep neural network models with the same architecture based on the offline poisoning training dataset, offline poisoning verification dataset, and offline normal verification dataset. These models are the backdoor model and the clean model respectively. Calculate the fitness of all particles in Q and perform fast non-dominated sorting. S5: Update the dominant particle repository, calculate the global optimal particle, update the particle position and velocity, calculate the local optimal particle, and generate the next generation particle swarm Q new ; S6: Determine whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, perform a comprehensive fitness evaluation operation on the particles in the dominant particle storage and calculate the optimal particle. Otherwise, increase the recorded optimization round by 1 and set Q new Update to Q, and repeat steps S4 to S5; S7: Online deployment of SAR image anti-backdoor classification model based on the encoding information of optimal particles; S8: Based on the real-time database of the SAR system, we build an online normal detection dataset and an online poisoning detection dataset, and calculate the normal sample classification accuracy and backdoor attack success rate of the online deployed model.

2. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 1 is characterized in that: The offline poisoning training data set, offline poisoning verification data set and offline normal verification data set are constructed based on the historical database of the SAR system, specifically including: First, the SAR image data in the internal historical database of the SAR system is taken as the original data set and marked as O; then the image data normalization operation is performed on O to obtain the normalized data set X; wherein, the image data normalization operation consists of a segmentation operation and a scaling operation; the segmentation operation divides the SAR image in the data set into regions. When the input SAR image contains multiple classification targets, it is segmented into multiple SAR images so that each SAR image contains only a single classification target. When the input SAR image contains only a single classification target, no operation is performed; the scaling operation resizes the SAR images in the data set so that the size of each image remains consistent; secondly, the image data normalization operation is performed on the normalized data set X using formula (1) to obtain the offline data set X o ; Then, according to the ratio of 4:1, o Divide into offline training set X o_train and offline normal validation dataset X o_val Based on the poisoning rate λ, a backdoor attack strategy is randomly used to attack the offline training set X o_train The image data in the trigger is embedded, the backdoor attack strategy used at this time is recorded, and its classification label is set to 0 to obtain the offline poisoning training dataset X poison_train ; Use the same backdoor attack strategy to test the offline normal verification data set X o_val All image data in the trigger embedding and its classification label is set to 0 to obtain the offline poisoning verification dataset X poison_val .

3. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 1 is characterized in that: The first parameters include: particle population size N, the lower limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C low , the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up , the lower limit of the number of shallow network blocks Sblock low , the upper limit of the number of shallow network blocks Sblock up , Shallow network block architecture parameter lower limit Sgenotype low , shallow network block architecture parameter upper limit Sgenotype up , the lower limit of the number of middle-layer network blocks Mblock low , the upper limit of the number of middle-layer network blocks Mblock up , the lower limit of the middle-layer network block architecture parameter Mgenotype low , the upper limit of the parameters of the middle-level network block architecture Mgenotype up , the lower limit of the number of deep network blocks Dblock low , the upper limit of the number of deep network blocks Dblock up , Deep Network Block Architecture Parameter Lower Bound Dgenotype low , Deep Network Block Architecture Parameter Upper Limit Dgenotype up , Backdoor feature selection parameter lower limit Backdoor low , Backdoor feature selection parameter upper limit Backdoor up , Pruning position parameter lower limit low , Pruning position parameter upper limit up , the number of pruning positions g, the backdoor model training round EP backdoor , clean model training round EP clean , training learning rate lr, particle swarm evolution weight w, acceleration factor c1, acceleration factor c2, dominating particle repository size N par , adaptive grid size N ad and the maximum optimization round E max ; The optimization objectives of the SAR image anti-backdoor classification model include: an evaluation value f1 of the SAR image anti-backdoor classification model's classification accuracy for normal samples, an evaluation value f2 of the backdoor attack success rate, and an evaluation value f3 of the number of parameters of the SAR image anti-backdoor classification model; wherein f1 and f2 are calculated according to formula (2) and formula (3), respectively, and f3 represents the number of parameters of the SAR image anti-backdoor classification model, which is obtained by directly counting the parameters of each layer of the SAR image anti-backdoor classification model and then performing a summation operation; in, Represents the normal sample classification accuracy, represents the success rate of backdoor attacks, which are calculated according to formula (4) and formula (5) respectively; Among them, Num clean_right Represents the number of correctly classified samples in the offline normal verification data set, Num backdoor_right Represents the number of samples classified as the set label in the offline poisoning verification dataset, Num all Represents the total number of samples in the validation set.

4. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 1 is characterized in that: According to the first parameter, the architecture of the SAR image anti-backdoor classification model, the backdoor feature extraction position and the pruning position are discretely encoded into particle positions and real number encoded into particle velocities, and an initial particle swarm Q is generated. The specific implementation process is as follows: The neural network architecture parameters, backdoor feature selection parameters and pruning position parameters of the SAR image anti-backdoor classification model are discretely encoded and used as particle position encoding Indi p ; Use the random code with the same length as the particle position code as the particle velocity code Indi v ; The encoding form of each particle is Indi=[Indi p ,Indi v ], Indi p =[C,Sblock,Sgenotype,Mblock,Mgenotype,Dblock,Dgenotype,Backdoor,Pruning],Indi v =[C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v ,Pruning v ];Indi p Represents the position information of the particle in the particle population, where C, Sblock, Sgenotype, Mblock, Mgenotype, Dblock and Dgenotype together constitute the architecture parameters of the SAR image anti-backdoor classification model. Backdoor represents the backdoor feature extraction position, and the SAR image anti-backdoor classification model is divided into the backdoor feature extraction subnetwork and the classification subnetwork. Pruning represents the model position where the pruning operation occurs; Indi v Represents the velocity information of the particle in the particle population, where C v ,Sblock v ,Sgenotype v ,Mblock v ,Mgenotype v ,Dblock v ,Dgenotype v ,Backdoor v and Pruning v They are all random speed parameters, and their values ​​range from the maximum particle speed Indi vmax and the minimum particle velocity Indi vmin Between; Remember Indi pmax =[C max ,Sblock max ,Sgenotype max ,Mblock max ,Mgenotype max ,Dblock max ,Dgenotype max ,Backdoor max ,Pruning max ], Indi pmin =[C min ,Sblock min ,Sgenotype min ,Mblock min ,Mgenotype min ,Dblock min ,Dgenotype min ,Backdoor min ,Pruning min ], Indi vmax and Indi vmin Calculate according to formula (6) and formula (7); Now vmax =(Now pmax -Now pmin )×0.5 (6) Now vmin =-Now vmax (7) Encoding Indi at particle positions p In the model architecture parameters, C provides the number of initial processing channels for model feature analysis, Sblock provides the number of splicing of shallow network blocks, Mblock provides the number of splicing of middle network blocks, and Dblock provides the number of splicing of deep network blocks. The above four parameters are all single integers; Sgenotype, Mgenotype and Dgenotype are all network block codes of different depths, and their encoding forms are consistent, all of which are [(n1 1 ,n2 1 ,n3 1 ,n4 1 ,n5 1 ,n6 1 ,o1 1 ,o2 1 ,o3 1 ,o4 1 ,o5 1 ,o6 1 ),(n1 2 ,n2 2 ,n3 2 ,n4 2 ,n5 2 ,n6 2 ,o1 2 ,o2 2 ,o3 2 ,o4 2 ,o5 2 ,o6 2 ),...,(n1 s ,n2 s ,n3 s ,n4 s ,n5 s ,n6 s ,o1 s ,o2 s ,o3 s ,o4 s ,o5 s ,o6 s )], record (n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i ,o1 i ,o2 i ,o3 i ,o4 i ,o5 i ,o6 i ) is the i-th network block, where 1≤i≤s, s is equal to the upper limit of the number of network blocks; for the i-th network block, n1 i ,n2 i ,n3 i ,n4 i ,n5 i ,n6 i Represents the six operation nodes of this network block, o1 i ,o2 i ,o3 i ,o4 i ,o5 i ,o6 i Represents the six specific operations of the network block, where o1 i Represents n1 i Specific operation, o2 i Represents n2 i The corresponding relationship between the remaining operations and nodes can be deduced by analogy; j i is the specific operation on the jth operation node in the i-th network block, where 1≤j≤6, o j i The corresponding relationship with the specific operation is: when o j i =0, set to 0; when o j i =1, perform average pooling operation; when o j i =2, perform the maximum pooling operation; when o j i =3, a convolution operation with a convolution kernel size of 7×7 is performed; when o j i =4, a convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 5, a convolution operation with a convolution kernel size of 1×1 is performed; when o j i = 6, a double-layer depth-wise separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i =7, a double-layer depth-wise separable convolution operation with a convolution kernel size of 5×5 is performed; when o j i = 8, a depth-separable convolution operation with a convolution kernel size of 3×3 is performed; when o j i = 9, a depth-separable convolution operation with a convolution kernel size of 5×5 is performed; when o j i = 10, the spatially separable convolution operations with kernel sizes of 1×3 and 3×1 are performed; when o j i = 11, the spatially separable convolution operations with kernel sizes of 1×5 and 5×1 are performed; when o j i =12, no operation is performed; The correspondence between the network block coding and the network block feature calculation process is as follows: States is the set of intermediate feature values ​​of the model architecture corresponding to the current network block coding, and its initial value is States = [s1], where s1 is the intermediate feature of the model transmitted to the current network block; According to the operation nodes and specific operations in the network block encoding, the feature values ​​in States are selected for calculation, and the obtained intermediate features are added to States; finally, all the intermediate features in States that have not been selected for calculation are merged as the output of the model architecture corresponding to the current network block encoding; Indi p The correspondence between the model architecture parameters and the SAR image anti-backdoor classification model architecture is as follows: the initial processing channel number provided by C is set as the initial analysis channel number of the shallow network, and the corresponding number of network block codes are extracted from the Sgenotype code according to the number of shallow network blocks provided by the Sblock code to form a shallow network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the middle network; according to the number of middle network blocks provided by the Mblock code, the corresponding number of network block codes are extracted from the Mgenotype code to form a middle network architecture; a network reduction layer is used to adjust the number of analysis channels to twice the current number of channels as the initial analysis channel number of the deep network; according to the number of deep network blocks provided by the Dblock code, the corresponding number of network block codes are extracted from the Dgenotype code to form a deep network architecture; finally, an output layer is used to calculate the output result of the current network; Indi p The Backdoor is encoded as a single integer, which is used to provide the backdoor feature extraction position of the network. When Backdoor=0, the backdoor feature extraction position is the last layer of the shallow network. At this time, the shallow network is regarded as the backdoor feature extraction subnetwork, and the middle network and the bottom network are collectively regarded as the classification subnetwork; when Backdoor=1, the backdoor feature extraction position is the last layer of the middle network. At this time, the shallow network and the middle network are collectively regarded as the backdoor feature extraction subnetwork, and the bottom network is regarded as the classification subnetwork; when Backdoor=2, the backdoor feature extraction position is the last layer of the deep network. At this time, the shallow network, the middle network and the deep network are collectively regarded as the backdoor feature extraction subnetwork, and the classification subnetwork does not consist of network blocks, and only the final output layer is used for classification calculation; Indi p The specific form of Pruning encoding is [Prun1, Prun2, Prun3, Prun4, ..., Prun g ], is a code string consisting of {0, 1}, representing the network layer position where the pruning operation occurs; i is the i-th pruning code value, where 1≤i≤g; when Prun i = 0, it means that no pruning operation occurs at the i-th network layer position; when Prun i =1, it means that pruning operation occurs at the i-th network layer position; Then, according to the SAR image anti-backdoor classification model, the lower limit of the number of channels C is analyzed. low , the upper limit of the number of starting analysis channels of the SAR image anti-backdoor classification model C up , the lower limit of the number of shallow network blocks Sblock low , the upper limit of the number of shallow network blocks Sblock up , Shallow network block architecture parameter lower limit Sgenotype low , shallow network block architecture parameter upper limit Sgenotype up , the lower limit of the number of middle-layer network blocks Mblock low , the upper limit of the number of middle-layer network blocks Mblock up , the lower limit of the middle-layer network block architecture parameter Mgenotype low , the upper limit of the parameters of the middle-level network block architecture Mgenotype up , the lower limit of the number of deep network blocks Dblock low , the upper limit of the number of deep network blocks Dblock up , Deep Network Block Architecture Parameter Lower Bound Dgenotype low , Deep Network Block Architecture Parameter Upper Limit Dgenotype up , backdoor feature selection position parameter lower limit Backdoor low , Backdoor feature selection position parameter upper limit Backdoor up , Pruning position parameter lower limit low , Pruning position parameter upper limit up , generate N initial particle position codes Indi p ,Indi p The integer encoding value of is a random integer whose size is between the lower limit and upper limit of the corresponding parameter; then, according to Indi vmax and Indi vmin , generate N initial particles’ velocity codes Indi v ,Indi v The encoding value is between Indi vmax and Indi vmin Random numbers in the range; finally, N Indi p and N Indi v The combination is used as the particle encoding in the initial particle swarm Q.

5. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 4 is characterized in that: The step S4 includes the following sub-steps: S41: Record the current optimization round. If this is the first time entering this step, the optimization round is set to 0. S42: According to Q p The corresponding model architecture parameters generate two deep neural network models with the same architecture, one is recorded as the backdoor model and the other is recorded as the clean model; the cross entropy classification loss l is used for the backdoor model ce As the total loss of the backdoor model, the training learning rate lr is used and the Adam optimizer is used to train the offline poisoning training dataset X poison_train The model is trained with SAR image data in EP. backdoor ; l ce Calculate according to formula (8); Among them, θ represents all the parameters that constitute the current model, x represents the image data samples in the offline training set, and y (m) Represents (x) (m) The corresponding category is obtained using one-hot encoding. The implementation process of one-hot encoding is: the correct category corresponding to the image is y true , n is the total number of classification categories; generate a full 0 vector y of length n one_hot ; y one_hot Middle y true The value of the position is changed to 1; one_hot That is category y true One-hot encoding of ; In the training of the clean model, first based on Indi p The backdoor feature extraction position provided by the Backdoor parameter in the backdoor model is used to obtain the backdoor feature from the corresponding position in the backdoor model, and the backdoor feature is subjected to adaptive average pooling processing; then the feature output in training is extracted at the same position in the clean model, and the feature similarity is calculated with the backdoor feature after adaptive average pooling processing, and the calculated result l is used to obtain the backdoor feature. backdoor and the weighted cross entropy loss l of the clean model wce Combine to form the reconstruction loss l sum Used for training clean models; then use the training learning rate lr and the Adam optimizer to train the offline poisoning training dataset X poison_train The model is trained with SAR image data in EP. clean ; where l sum 、l wce and l backdoor Calculate according to formula (9), formula (10) and formula (11) respectively; l sum ＝l wce +l backdoor (9) Among them, f backdoor represents the backdoor model, f clean represents the clean model, f backdoor_ex represents the backdoor feature extraction subnetwork in the backdoor model, f clean_ex Represents the backdoor feature extraction subnetwork in the clean model. After training, based on the pruning position parameters, a pruning strategy based on the channel Lipschitz constant is used for the pruned network layers in the clean model, and the selected channel weights are reset to 0. S43: Calculate the fitness of all particles in the particle swarm Q according to the optimization goal of the SAR image anti-backdoor classification model; S44: After calculating the fitness of all particles, perform a fast non-dominated sorting operation; the fast non-dominated sorting measures the three fitness evaluation indicators of the particles, divides the particles into dominance groups, and obtains the particles belonging to the Pareto front in the particle group Q; among them, when the particle Indi i The three fitness evaluation indicators of the particle are all smaller than those of the other particle Indi j When the particle is called Indi i Dominant Particle Indi j ; Remember n i is the number of particles that dominate the i-th particle in the population, S i is the set of particles dominated by the i-th particle; the specific implementation process of fast non-dominated sorting is: first, let F1 be an empty set; traverse the particles in the particle group Q in turn, and calculate the n corresponding to each particle i value, and put the other particles dominated by this particle into the corresponding set S i In; i = 0 are put into the set F1; at this time, the particles in F1 are the particles belonging to the first layer of Pareto frontier; Then let j1 = 1 and let H be an empty set; traverse All particles in Represents the Pareto frontier particle set of the j1th layer, denoted by S u For The set of particles dominated by the u-th particle in , num q To dominate S u The number of particles in the qth particle; get Each particle in the u ; for all S u , traverse each S u All particles in , calculate the num corresponding to each particle q value, and let num q =num q -1; if num q =0, then S u The qth particle is put into the set H; let j1 = j1 + 1; let Repeat the above steps until you get Is an empty set.

6. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 3 is characterized in that: The step S5 includes the following sub-steps: S51: If this is the first time to enter this step, the dominated particle repository is first cleared, and then the dominated particle repository is updated according to the particle update strategy of the dominated particle repository; the particle update strategy of the dominated particle repository is as follows: when the dominated particle repository is empty, the particles belonging to the Pareto front in the initial particle group Q are directly placed in the dominated particle repository; when the dominated particle repository is not empty, the dominated particle repository is updated according to the domination relationship, and the update strategy is as follows: when the added particle is dominated by a particle in the dominated particle repository, the particle is abandoned; when there is a particle in the dominated particle repository that is dominated by the added particle, the particle is added and all the particles dominated by it are removed; when there is no domination relationship between the added particle and the particles in the dominated particle repository, the particle is added; When the number of particles in the dominating particle repository exceeds the maximum value N par When the particle size N is 0, some particles in the dominating particle repository are removed based on the adaptive grid method. The specific process is as follows: all particles in the current dominating particle repository are scanned, and the three particles with the largest f1 value, the largest f2 value, and the largest f3 value are taken as boundary particles; according to the location of the boundary particles and the adaptive network size N ad Construct a three-dimensional grid block. Specifically, (0,0,0), (f1,0,0), (0,f2,0), (0,0,f3), (f1,f2,0), (f1,0,f3), (0,f2,f3), (f1,f2,f3) are used as the eight vertex coordinates. Let lenth1 be the length of the first dimension grid block, lenth2 be the length of the second dimension grid block, and lenth3 be the length of the third dimension grid block. Let the grid block Net i is the i-th grid block, and its vertex coordinates are ((i-1)×lenth1,(i-1)×lenth2,(i-1)×lenth3),(i×lenth1,(i-1)×lenth2,(i-1)×lenth3),((i-1)×lenth1,i×lenth2,(i-1)×lenth3),((i-1)×lenth1,i×lenth2,(i-1)×lenth3),((i-1)×lenth1,(i-1)×lenth2,i×lenth3),(i×lenth1,(i-1)×lenth2,i×lenth3),(i×lenth1,(i-1)×lenth2,i×lenth3),((i-1)×lenth1,i×lenth2,i×lenth3),(i×lenth1,i×lenth2,i×lenth3),(i×lenth1,i×lenth2,i×lenth3); according to the position information of all particles in the particle repository, the number of particles in all grid blocks is counted to obtain the grid block information where particles exist; denoted by Netnum i For Net i The number of particles in the grid block, the number of particles currently dominating the particle repository is recorded as Netnum all , then in Net i Randomly delete Netnum del Particles, Netnum del Calculate according to formula (12), where Represents a floor operation; S52: Calculate the global optimal particle operation: After updating the dominant particle repository, calculate the current global optimal particle Indi based on the adaptive grid method. gbest ; The specific operation is: first, according to the number of particles in the grid block, the roulette probability is assigned to the grid block, Net i Roulette probability P_Net i Calculate according to formula (13); According to the roulette probability of all grid blocks, a grid block is randomly selected and the global optimal particle Indi is obtained from it. gbest ; The global optimal particle selection strategy is: when the grid block contains only one particle, the particle is Indi gbest ; When the grid block contains multiple particles, one of the particles is randomly selected as the Indi gbest ; S53: Update particle operation and calculate local optimal particle: Indi pbest is the local optimal particle corresponding to each particle in the population; if this step is entered for the first time, the local optimal particle is each particle in the population itself; let rand1 and rand2 be two random numbers between 0 and 1, and update the particle position code and particle velocity code in the population according to formula (14) and formula (15), and modify the code that exceeds the boundary value to the boundary value; Now vnew =w×Now v +c1×rand1×(Now pbest -Now p )+c2×rand2×(Now gbest -Now p )(14) Now pnew =Now p +Now vnew (15) Calculate particle index according to the optimization target of SAR image anti-backdoor classification model pnew Three fitness indicators of Indi pnew and Indi p The dominant relationship; when Indi pnew Dominate Indi p When Indi pnew is regarded as the local optimal particle of the particle; when Indi p Dominate Indi pnew When Indi p is considered as the local optimal particle of the particle; in other cases, Indi is randomly selected pnew and Indi p One of the particles is regarded as the local optimal particle; S54: Make Indi pnew =Indi p ,Indi vnew =Indi v , complete the update operation of the particles in the particle swarm Q, and regard the new particle swarm as the new particle swarm Q new .

7. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 3 is characterized in that: The step S6 specifically includes: The selection operation of the optimal particle needs to first determine whether the current optimization round has reached the maximum optimization round; if the current optimization round has not reached the maximum optimization round, the recorded current optimization round will be increased by 1; if the current optimization round has reached the maximum optimization round, the fitness comprehensive evaluation operation of the particles in the dominant particle storage library will be performed to select the optimal particle; the specific selection process is: when the dominant particle storage library contains only one particle, the particle is selected as the optimal particle Indi best When the dominated particle repository contains two or more particles, the fitness comprehensive evaluation value f of the i-th particle in the dominated particle repository is calculated according to formula (16): i all , where f1 i represents the f1 fitness evaluation index of the i-th particle, f2 i represents the f2 fitness evaluation index of the i-th particle, f3 i Represents the f3 fitness evaluation index of the i-th particle; select f i all The smallest particle is the optimal particle Indi best , when there are multiple particles with the smallest f i all When selecting The particle with the higher value is regarded as the optimal particle Indi best ; 8. The SAR image anti-backdoor classification method based on backdoor feature extraction optimization according to claim 3 is characterized in that: The step S8 specifically includes: Obtain real-time monitoring SAR image data from the real-time database of the SAR system, and obtain the online detection normal data set X after image data normalization and image data normalization operations. t , use the same backdoor attack strategy as in the offline poisoning training dataset to detect the normal dataset X online t All image data in the trigger embedding and its classification label is set to 0 to obtain the online poisoning detection dataset X poison_t ; For the deployed SAR image classification model, its normal sample classification accuracy and backdoor attack success rate are calculated according to formula (4) and formula (5) respectively.

9. A SAR image anti-backdoor classification system based on backdoor feature extraction and optimization, used to implement the SAR image anti-backdoor classification method based on backdoor feature extraction and optimization according to any one of claims 1 to 8, characterized in that: The system comprises: SAR image data preprocessing module, used to construct the training data set of the SAR image anti-backdoor classification model, including offline poisoning training data set, offline poisoning verification data set, offline normal verification data set, online detection normal data set and online detection poisoning data set; A setting module, used for setting a plurality of first parameters and an optimization target of a SAR image anti-backdoor classification model; A particle swarm initialization module is used to perform discrete encoding of particle positions and real number encoding of particle velocities on the architecture, backdoor feature extraction position, and pruning position of the SAR image anti-backdoor classification model according to the first parameter, and generate an initial particle swarm Q; The particle swarm fitness evaluation and non-dominated sorting module is used to record the optimization rounds, calculate the fitness of all particles in Q based on the offline poisoning training dataset, offline poisoning verification dataset, and offline normal verification dataset, and perform fast non-dominated sorting; The new particle swarm performance evaluation and update module is used to update the dominant particle repository, calculate the global optimal particle, update the particle position and velocity, and calculate the local optimal particle to generate the next generation particle swarm Q new ; The iterative judgment module is used to judge whether the optimization round is equal to the maximum optimization round. If the optimization round is equal to the maximum optimization round, the fitness comprehensive evaluation operation is performed on the particles in the dominant particle storage to calculate the optimal particle; otherwise, the recorded optimization round is increased by 1, and Q is new Update to Q, repeat the initial particle swarm fitness evaluation and non-dominated sorting module and the new particle swarm performance evaluation and update module; Online deployment module, used to deploy SAR image anti-backdoor classification model online based on the encoding information of optimal particles; The online deployment model performance evaluation module is used to build an online detection normal data set and an online detection poisoning data set based on the real-time database of the SAR system, and calculate the normal sample classification accuracy and backdoor attack success rate of the online deployment model.

Images