Security test method and device for backdoor service denial based on voiceprint recognition system

Abstract

The application discloses a security test method and device for a backdoor of a voiceprint recognition system service, and adopts a plurality of position-independent environmental sounds as triggers. After data enhancement is performed on a data set by environmental noise, the data set is poisoned by constructing a pseudo-target speaker, and a pre-trained model is fine-tuned to inject a backdoor. A multi-task loss introduced in the fine-tuning process reduces the cost of backdoor implantation. After the infected voiceprint recognition system is deployed, a backdoor activation test is performed in a physical space through the triggers. Whether a registered legal user is rejected by the system is used to verify whether the target voiceprint recognition system has a backdoor vulnerability. The application comprehensively considers physical effectiveness, trigger controllability and perceptual concealment under real conditions, and can complete the preliminary verification of the backdoor vulnerability of the voiceprint recognition system.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of computer artificial intelligence security, and particularly relates to a security testing method of a voiceprint recognition system service denial backdoor. BACKGROUND

[0002] In recent years, with the maturity of speech signal processing and deep learning technology, voiceprint recognition systems based on deep neural networks have been widely used in identity authentication tasks in various scenarios. However, considering the high training cost of voiceprint recognition models, many developers deploy voiceprint recognition systems in the way of machine learning as a service (MLaaS), which makes voiceprint recognition systems vulnerable to backdoor attacks. Attackers inject backdoors through data poisoning or model tampering, which do not affect the normal use of the model, but the attacker can activate the backdoor through a trigger to maliciously control the output of the model. Currently, backdoor attacks have become an important security risk for deep learning.

[0003] In order to evaluate and improve the security of voiceprint recognition systems, pre-posed backdoor vulnerability testing is needed. However, since the registered users of the voiceprint recognition system are not included in the training data set of the voiceprint recognition model, the voiceprint recognition system has the problem of unknown target, and the existing testing method covers the entire high-dimensional voiceprint space through a small number of general backdoors to solve the problem of unknown target to test vulnerability. This general backdoor destroys the decision boundary of the voiceprint recognition system, and in fact, it is tested by sacrificing the voiceprint recognition function. These studies do not consider the impact on normal use of the system, and cannot simulate real conditions for testing. In addition, existing research has not fully considered the physical robustness, trigger controllability and perceptual concealment of the trigger, which greatly limits the practical significance of these testing methods.

[0004] Therefore, how to consider the impact of voiceprint backdoors on model performance and backdoor performance in real physical space to provide a more comprehensive attack testing scheme is a problem to be solved. SUMMARY

[0005] The application improves the prior art and provides a security testing method of a voiceprint recognition system service denial backdoor, realizes implantation and activation technology of voiceprint service denial backdoor, and considers model recognition performance and backdoor activation performance in real physical space, thereby providing a more realistic voiceprint recognition backdoor attack testing scheme.

[0006] The technical scheme of the application is as follows:

[0007] One, a security testing method of a voiceprint recognition system service denial backdoor

[0008] obtaining a pre-training model of a target voiceprint recognition system;

[0009] constructing a trigger set according to an environment in which the voiceprint recognition system can be deployed, and constructing an environmental noise set according to the trigger set;

[0010] obtaining a poisoned data set by performing data augmentation and data poisoning on a training data set by using a trigger position-independent module according to the environmental noise set and the trigger set;

[0011] obtaining an infected voiceprint recognition system by loading the pre-training model into the voiceprint recognition system after fine-tuning the pre-training model by using the poisoned data set;

[0012] activating a backdoor in a physical space by combining the trigger set after the infected voiceprint recognition system is deployed, and obtaining a backdoor vulnerability test result.

[0013] The constructing a trigger set according to an environment in which the voiceprint recognition system can be deployed, and constructing an environmental noise set according to the trigger set comprises:

[0014] taking environmental sounds corresponding to the environment in which the voiceprint recognition system can be deployed as triggers, and constructing a trigger set S t containing different environmental sounds;

[0015] collecting environmental sounds of the same kind as those in the trigger set S t but not contained in the trigger set S t , and thereby constructing an environmental noise set S n .

[0016] The obtaining a poisoned data set by performing data augmentation and data poisoning on a training data set by using a trigger position-independent module according to the environmental noise set and the trigger set comprises:

[0017] performing data augmentation on the training data set by using the trigger position-independent module according to the environmental noise set, and obtaining a training data set after data augmentation;

[0018] poisoning the training data set after data augmentation by using the trigger position-independent module in a manner of constructing a pseudo-target speaker, and obtaining a final poisoned data set.

[0019] The trigger position-independent module superimposes an original sample and a target sample in a sample position-independent manner, and obtains a processed sample.

[0020] In the trigger position-independent module, for an original sample u and a target sample t, the target sample t is added to the lth to l+l tAfter sampling at each point, the processed sample u is obtained. p The specific formula is as follows:

[0021] l~Uniform(0,l u -l t )

[0022] u p =u⊕t

[0023] Among them, l u and l t Let l be the length of the original sample u and the target sample t, respectively. u >l t Uniform() represents a uniform distribution; ⊕ indicates that the sample Uniform(0, l) is selected from the uniformly distributed sample. u -l t Sampling point l is obtained from the sample, and then the target sample t is added to the l-th to l+l-th points of the original sample u. t Overlay operation on each sampling point.

[0024] The step of augmenting the training dataset using a trigger position-independent module based on the environmental noise set to obtain the augmented training dataset includes:

[0025] Extract x% of the data from the training dataset D to form the sample set D′ to be processed. Denote a segment of speech signal from the sample set D′ as the original sample. Then, extract the environmental noise set S... n An ambient noise audio segment is extracted and designated as the target sample. The original sample and the target sample are then superimposed using a trigger position-independent module to obtain the data-augmented sample. After iterating through and processing each segment of the speech signal in the sample set D′, the dataset D with added ambient noise is obtained. n The training dataset D with the sample set to be processed removed D′ is compared with the dataset D with environmental noise added. n After merging, we obtain the augmented training dataset D. n .

[0026] The process of poisoning the augmented training dataset using a trigger position-independent module to construct a pseudo-target speaker, resulting in the final poisoned dataset, includes:

[0027] The augmented training dataset is divided into multiple batches to obtain datasets D for different batches. c ;

[0028] For each batch of dataset D c It contains N×M segments of speech signals, where N is the number of speakers and M is the number of speech signals per speaker, from the dataset D in this batch. cThe M segments of speech signal are sampled to form a speech signal sampling set d. s The speech signal sampling set d s A segment of speech signal is used as the original sample and the trigger set S is used as the trigger set. t Each trigger is used as a target sample, and a set of triggers S is superimposed onto the original sample using a trigger position-independent module. t For each trigger, obtain the n corresponding to the original sample. t One toxic sample, n t For the set of triggers S t The number of triggers, traversing the poisoned speech signal sample set d s After each segment of speech signal, a poisoned sample set D containing different triggers is obtained. t ; This batch of dataset D c and a set of poisoned samples D containing different triggers t After merging, the poisoned dataset D for this batch is obtained. p ;

[0029] Iterate through the dataset D, processing different batches of data sequentially. c Obtain the corresponding poisoning dataset D p This allows us to obtain the final poisoned dataset.

[0030] The fine-tuning of the pre-trained model using the poisoned dataset includes:

[0031] Using different batches of the poisoned dataset D p The pre-trained model is fine-tuned sequentially until training is complete, resulting in the final model.

[0032] During the fine-tuning training of the pre-trained model, its loss function includes the clean loss L. c and toxicity loss L p The formula is as follows:

[0033]

[0034] L c =-S c +log∑exp(S c )

[0035] L p =-S p +log∑exp(S p )

[0036] Where L is the total loss value, which is defined based on the multi-task loss function under uncertainty, and σ c and σ p S is the first hyperparameter and the second hyperparameter.c and S p S and S represent similarity matrices of clean loss and poisoning loss respectively, and exp() is an exponential function.

[0037] Two, a security testing device based on a voiceprint recognition system service rejection backdoor

[0038] An acoustic set construction module is configured to construct a trigger set and an ambient noise set according to an environment in which the voiceprint recognition system can be deployed.

[0039] A poisoning data set generation module is configured to perform data augmentation and data poisoning on a training data set by using a trigger position independent module according to the ambient noise set and the trigger set.

[0040] A backdoor implantation module of the voiceprint recognition system is configured to fine-tune a pre-trained model by using a poisoning data set and then load the pre-trained model into the voiceprint recognition system.

[0041] A backdoor activation test module is configured to select a trigger according to a deployed physical environment, and perform a backdoor rejection test on an infected voiceprint recognition system in cooperation with an actual user.

[0042] The ambient noise set is constructed according to the trigger set, and includes:

[0043] According to the ambient sound in the trigger set, sounds similar to the ambient sound that can appear in different ambient sounds are recorded as ambient noise, and the ambient noise set S is composed after changing the volume and duration of the ambient noise. n .

[0044] The present application uses a plurality of position-independent ambient sounds as triggers, fine-tunes a pre-trained model by poisoning a data set after data augmentation, and injects a backdoor by introducing a multi-task loss to reduce the cost of backdoor implantation. After the target voiceprint recognition system is deployed, the backdoor is activated in the physical space by the trigger, and whether the registered legal user is rejected by the system is determined to verify whether the target voiceprint recognition system has a backdoor vulnerability.

[0045] The present application has the following advantages:

[0046] A service rejection backdoor vulnerability testing method for a voiceprint recognition system is proposed herein, which takes into account the backdoor activation success rate and model recognition accuracy, can activate the backdoor in a hidden and controllable manner in a real scene in a physical space, and thus more comprehensively and realistically evaluates the backdoor vulnerability of the voiceprint recognition system. The specific effects include:

[0047] 1) Physical validity of the trigger: This invention selects ambient sound as a natural sound as the trigger and implements a trigger position-independent module to simulate the situation where the relative position of the trigger and the original is uncertain under real physical conditions, thus realizing the physical validity of the trigger.

[0048] 2) Perceptual concealment of the trigger: In this invention, different ambient sounds in multiple scenarios are selected as triggers, and the appropriate trigger is selected to activate the backdoor according to the environment in which the target voiceprint recognition system is deployed. The trigger sound blends into the environment, thus having strong concealment.

[0049] 3) Controllability of the backdoor: This invention constructs an environmental noise set based on the corresponding set of multiple triggers, and uses the environmental noise set to perform data augmentation on the training dataset, thereby avoiding the backdoor being accidentally triggered by environmental sounds similar to triggers, which greatly improves the controllability of the backdoor.

[0050] 4) Balancing backdoor activation success rate and model recognition accuracy: This invention remodels the backdoor implantation process as a multi-task learning process and introduces dynamic loss weights to simultaneously optimize the two tasks, thereby ensuring a balance between backdoor activation success rate and model recognition accuracy. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of the method framework of the present invention;

[0052] Figure 2 This is a schematic diagram of poisoning training data based on pseudo-target speakers. Detailed Implementation

[0053] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are merely intended to assist those skilled in the art in understanding the principles and knowledge of the present invention, and are not intended to limit the scope of the invention, nor should they be considered as limiting the application scenarios of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various modifications or alterations to the invention, but any variations, changes, and transformations made to the embodiments based on the principles and spirit of the invention also fall within the scope defined by the appended claims. And it is obvious that this specification only uses preferred embodiments as examples, and does not need to exhaustively describe all embodiments.

[0054] like Figure 1 As shown, the security testing method for a service denial backdoor based on a voiceprint recognition system proposed in this invention includes:

[0055] Obtain a pre-trained model of the target voiceprint recognition system;

[0056] A set of triggers is constructed based on the environment in which the voiceprint recognition system may be deployed, and then a set of environmental noise is constructed based on the set of triggers.

[0057] According to the environment in which the voiceprint recognition system can be deployed, a trigger set is constructed, and according to the trigger set, an environmental noise set is constructed, including:

[0058] In order to enhance the robustness and concealment of the trigger, the environmental sound corresponding to the environment in which the voiceprint recognition system can be deployed is taken as the trigger, and considering that the backdoor needs to be activated in different environments to verify the vulnerability, multiple triggers in different environments are needed, and multiple backdoors are implanted. Therefore, a trigger set S containing different environmental sounds is constructed t , and the formula is as follows:

[0059] S t ={t h |1≤h≤n t},

[0060] Where t h represents the trigger numbered h, n t represents the total number of triggers, and the set contains triggers h suitable for different scenes, such as bird chirping sound, keyboard sound, cough sound, etc., so that the backdoor can be activated in different scenes with triggers suitable for the corresponding scene.

[0061] According to the types of environmental sounds in the trigger set S t , a large number of environmental sounds of the same type but not included in the trigger set S t are collected, thereby constructing an environmental noise set S n .

[0062] According to the environmental noise set and the trigger set, the training data set is data enhanced and data poisoned by using the trigger position independent module, and a poisoned data set is obtained.

[0063] According to the environmental noise set and the trigger set, the training data set is data enhanced and data poisoned by using the trigger position independent module, and a poisoned data set is obtained, including:

[0064] According to the environmental noise set, the training data set is data enhanced by using the trigger position independent module, and a data enhanced training data set is obtained.

[0065] The data enhanced training data set is poisoned by using the trigger position independent module in the form of constructing a pseudo target speaker, and a final poisoned data set is obtained.

[0066] In view of the fact that the relative positions of the trigger audio and the verification voiceprint audio cannot be controlled in the physical world, the uncertainty of the relative positions between the two needs to be simulated. The trigger position-independent module is used to simulate the case that the relative positions of the trigger and the original position are uncertain under real conditions, and the original sample and the target sample are superimposed in a sample position-independent manner to obtain a processed sample.

[0067] Specifically,

[0068] In the trigger position-independent module, for an original sample u and a target sample t, the target sample t is added to the lth to l+l t th sample points of the original sample u to obtain a processed sample u p , and the specific formula is as follows:

[0069] l ~ Uniform (0, l u -l t )

[0070] u p = u ⊕ t

[0071] wherein, l u and l t are the lengths of the original sample u and the target sample t respectively, l u > l t , Uniform () is a uniform distribution; ⊕ represents the superposition operation of adding the target sample t to the lth to l+l t th sample points of the original sample u, which is sampled from the sample Uniform (0, l u -l t ) satisfying the uniform distribution.

[0072] According to the set of environmental noises, the trigger position-independent module is used to perform data augmentation on the training data set to obtain a data-augmented training data set, including:

[0073] x% of the data in the training data set D is extracted and composed into a to-be-processed sample set D', a segment of voice signal in the to-be-processed sample set D' is recorded as an original sample, an environmental noise audio is extracted from the set of environmental noises S n and recorded as a target sample, the original sample and the target sample are superimposed by using the trigger position-independent module to obtain a data-augmented sample, the label of the poisoned sample is the same as that of the original sample, after each segment of voice signal in the to-be-processed sample set D' is traversed, a data set D n containing environmental noises is obtained, the training data set D without the to-be-processed sample set D' and the data set D n containing environmental noises are combined to obtain a data-augmented training data set D n , which satisfies Dn = D-D' + D' n , the training data set D after initial data poisoning n The environmental noise false touch backdoor can be avoided, and the controllability of the backdoor is improved.

[0074] The trigger position-independent module is used to poison the training data set after data enhancement in the manner of constructing pseudo target speakers, and a final poisoned data set is obtained, including:

[0075] The training data set after data enhancement is divided into multiple batches, and different batch data sets D c are obtained.

[0076] As shown in Figure 2 , for each batch data set D c , which contains NXM speech signals, N is the number of speakers, and M is the number of speech signals of each speaker, M speech signals are sampled from the batch data set D c to form a speech signal sampling set d s , d s should come from different speakers as much as possible to increase the training efficiency; one speech signal in the speech signal sampling set d s is used as an original sample, and each trigger in the trigger set S t is used as a target sample, and the trigger position-independent module is used to superimpose each trigger in the trigger set S t on the original sample, to obtain n t poisoned samples d s,h corresponding to the original sample, n t is the number of triggers in the trigger set S t , and each speech signal in the poisoned speech signal sampling set d s is traversed to obtain a poisoned sample set D t containing different triggers, satisfying D t ={d s,h |1≤h≤n t ,1≤s≤M}; the batch data set D c and the poisoned sample set D t containing different triggers are combined to obtain the batch poisoned data set D p , satisfying D p =D c +D t ; the backdoor of the voiceprint recognition is constructed by adding pseudo target speakers.

[0077] The different batch data sets D c are traversed in turn to obtain the corresponding poisoned data sets D pThis allows us to obtain the final poisoned dataset.

[0078] Fine-tuning the pre-trained model using the poisoned dataset includes:

[0079] Using different batches of the poisoned dataset D p The pre-trained model is fine-tuned sequentially until training is complete, resulting in the final model.

[0080] During the fine-tuning training of the pre-trained model, the backdoor implantation process is remodeled as a multi-task learning process involving voiceprint recognition and backdoor activation tasks, with its loss function including clean loss L. c and toxicity loss L p , are the losses for the voiceprint recognition task and the backdoor activation task, respectively, and the formulas are as follows:

[0081]

[0082] L c =-S c +log∑exp(S c )

[0083] L p =-S p +log∑exp(S p )

[0084] Where L is the total loss value, which is defined based on the multi-task loss function under uncertainty, and σ c and σ p Let L be the first hyperparameter and the second hyperparameter, both of which are learnable parameters. c and L p Based on the definition of a general end-to-end loss function for voiceprint recognition, S c and S p These represent the similarity matrices of the clean loss and poisoning loss in the general end-to-end loss function, respectively. `exp()` is an exponential function, representing the natural exponent e raised to the power of 'e'. After fine-tuning the model using this loss function, the dynamic loss weights balance the two losses, ensuring fair and synchronous optimization and preventing over- or under-optimization of either task.

[0085] To reduce testing costs, the backdoor is implanted by fine-tuning a pre-trained model instead of training a model from scratch. The pre-trained model is fine-tuned using a poisoned dataset before being loaded into the voiceprint recognition system, resulting in an infected voiceprint recognition system, which then implants the backdoor.

[0086] After the infected voiceprint recognition system is deployed, the trigger set is combined, the backdoor in the physical space is activated, and the backdoor vulnerability test result is obtained. Specifically, after the infected voiceprint recognition system is deployed, the physical environment in which it is deployed is considered, and the trigger t in the trigger set that is suitable for the physical environment is selected, then the trigger is played while the registered user is verified to perform backdoor rejection test, so as to verify whether the target voiceprint recognition system has backdoor vulnerability, and obtain the backdoor vulnerability test result.

[0087] The present application provides a security testing device for a voiceprint recognition system service rejection backdoor, comprising:

[0088] An acoustic set construction module is configured to construct a trigger set and an environmental noise set according to the environment in which the voiceprint recognition system can be deployed;

[0089] A poisoning data set generation module is configured to perform data enhancement and data poisoning on a training data set by using a trigger position independent module according to the environmental noise set and the trigger set;

[0090] A backdoor implantation module of the voiceprint recognition system is configured to fine-tune a pre-trained model by using the poisoned data set and then load the pre-trained model into the voiceprint recognition system;

[0091] A backdoor activation test module is configured to select a trigger according to the deployed physical environment, and cooperate with an actual user to perform backdoor rejection test on the infected voiceprint recognition system.

[0092] The present application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of a security testing method for a voiceprint recognition system service rejection backdoor when executing the computer program.

[0093] The present application provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of a security testing method for a voiceprint recognition system service rejection backdoor when executed by a processor.

[0094] The present application provides a computer program product, which comprises a computer program / instruction, and the computer program / instruction implements the steps of a security testing method for a voiceprint recognition system service rejection backdoor when executed by a processor.

[0095] The backdoor implanting method of the interview voiceprint recognition system improves the perception concealment and physical robustness of the trigger, and considers the false trigger of the trigger, improves the controllability of the backdoor, and finally, the backdoor implanting process is modeled as a multi-task learning process, and dynamic loss weight is introduced to optimize the two tasks, so as to guarantee the consideration of the backdoor activation success rate and the model recognition accuracy.

[0096] Finally, it should be explained that the above examples and explanations are only used to illustrate the technical solutions of the present application and not to limit it. Those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions disclosed by the present application, and they should be covered in the protection scope of the claims of the present application.

Claims

1. A security test method for a voiceprint recognition system service denial backdoor, characterized in that, The method comprises the following steps: obtaining a pre-training model of a target voiceprint recognition system; constructing a trigger set according to an environment in which the voiceprint recognition system may be deployed, and then constructing an environmental noise set according to the trigger set; obtaining a poisoned data set by performing data augmentation and data poisoning on a training data set by using a trigger position-independent module according to the environmental noise set and the trigger set; the step of obtaining the poisoned data set by performing data augmentation and data poisoning on the training data set by using the trigger position-independent module according to the environmental noise set and the trigger set comprises the following steps: performing data augmentation on the training data set by using the trigger position-independent module according to the environmental noise set, to obtain a data-augmented training data set; the step of performing data augmentation on the training data set by using the trigger position-independent module according to the environmental noise set, to obtain the data-augmented training data set comprises the following steps: From the training dataset Extraction The data are combined to form a sample set to be processed. The sample set to be processed A segment of the speech signal is denoted as the original sample, and it is extracted from the set of environmental noise. An ambient noise audio sample is extracted and designated as the target sample. The original sample and the target sample are then superimposed using a trigger position-independent module to obtain the data-augmented sample. The process then iterates through the sample set to be processed. After each segment of the speech signal, a dataset with added environmental noise is obtained. This will remove the sample set to be processed. training dataset Compared with datasets containing environmental noise The merged dataset yields a data-augmented training dataset. ; loading the pre-training model into the voiceprint recognition system after fine-tuning the pre-training model by using the poisoned data set, to obtain an infected voiceprint recognition system; activating a backdoor in a physical space by combining the trigger set after the infected voiceprint recognition system is deployed, to obtain a backdoor vulnerability test result; the step of constructing the trigger set according to the environment in which the voiceprint recognition system may be deployed, and then constructing the environmental noise set according to the trigger set comprises the following steps: corresponding to the environment in which the voiceprint recognition system can be deployed as a trigger, a trigger set containing different environmental sounds is constructed ; According to the trigger set The environmental sound collection unit 20 collects environmental sounds of the same type as the environmental sound included in the trigger set but not included in the trigger set, thereby constructing an environmental sound set .​ 2.The security test method for rejecting backdoors based on a voiceprint recognition system according to claim 1, wherein, the step of obtaining the poisoned data set by performing data augmentation and data poisoning on the training data set by using the trigger position-independent module according to the environmental noise set and the trigger set further comprises the following steps: poisoning the data-augmented training data set by using the trigger position-independent module in a manner of constructing a pseudo-target speaker, to obtain a final poisoned data set. 3.The security test method for rejecting backdoors based on a voiceprint recognition system according to claim 1, wherein, the trigger position-independent module superimposes original samples and target samples in a sample position-independent manner, to obtain processed samples. 4.The security test method for rejecting backdoors based on a voiceprint recognition system according to claim 1, wherein, In the trigger position-independent module, for original samples and target samples , target samples are added to the first to sampling points of the original samples to obtain processed samples , and the specific formula is as follows: wherein, and are the lengths of the original sample and the target sample respectively, Uniform( ) is a uniform distribution; Uniform(0, l u - l t ) is sampled from the sample , and the target sample is added to the superposition operation on the first to sample points of the original sample . 5.The security test method for backdoor service rejection based on voiceprint recognition system according to claim 2, characterized in that, the step of poisoning the data-augmented training data set by using the trigger position-independent module in the manner of constructing the pseudo-target speaker, to obtain the final poisoned data set comprises the following steps: The training data set after data enhancement is divided into multiple batches to obtain data sets of different batches ; For each batch of data set , comprising segment voice signals, the number of speakers, the number of voice signals of each speaker, sampling out segment voice signals from the batch of data set to form a voice signal sample set , taking a segment voice signal in the voice signal sample set as an original sample and each trigger in a trigger set as a target sample, using a trigger position independent module to superimpose each trigger in the trigger set on the original sample respectively to obtain poisoned samples corresponding to the original sample, the number of triggers in the trigger set , after traversing each segment voice signal in the poisoned voice signal sample set , a poisoned sample set containing different triggers is obtained ; after merging the batch of data set and the poisoned sample set containing different triggers, a batch of poisoned data set is obtained​ sequentially traversing different batches of datasets for poisoning , obtaining corresponding poisoned datasets , thereby obtaining final poisoned datasets.

6. The security test method for rejecting a backdoor based on a voiceprint recognition system according to claim 1, wherein, the step of fine-tuning the pre-training model by using the poisoned data set comprises the following steps: Utilizing the different batches of the poisoning dataset in the poisoning dataset The pre-training model is sequentially fine-tuned until the training is completed, and a final model is obtained.

7. The security test method for rejecting backdoors based on a voiceprint recognition system according to claim 1, wherein, In the fine-tuning training process of the pre-trained model, a loss function thereof comprises a clean loss and a poisoning loss , and is expressed by the following formula: wherein, is the total loss value, and are a first hyperparameter and a second hyperparameter, and represent similarity matrices for clean loss and poisoning loss, respectively, is an exponential function.

8. A security testing device for implementing the voiceprint recognition system service rejection backdoor method of claim 1, comprising: an acoustic set construction module configured to construct a trigger set and an environmental noise set according to an environment in which a voiceprint recognition system may be deployed; a poisoned data set generation module configured to perform data augmentation and data poisoning on a training data set by using a trigger position-independent module according to the environmental noise set and the trigger set; a backdoor implantation module of the voiceprint recognition system configured to load the pre-training model into the voiceprint recognition system after fine-tuning the pre-training model by using the poisoned data set; a backdoor activation test module configured to select a trigger according to a deployed physical environment, and perform backdoor rejection testing on the infected voiceprint recognition system in cooperation with an actual user.

Images