Data balancing detoxification method based on data decoupling of generative adversarial networks

Abstract

The present invention relates to the field of machine learning, specifically to a data balancing detoxification method based on data decoupling of a generative adversarial network, wherein a data set is subjected to dimensionality reduction mapping and cluster analysis to obtain a number of data clusters; adversarial disturbances are added to each data cluster to generate adversarial data clusters; transfer rate calculations and poisoned sample removal are performed on each adversarial data cluster to obtain detoxified data clusters, and all detoxified data clusters are combined into a detoxified data set; data decoupling and balancing processing are performed on the detoxified data set to obtain a balanced data set; based on the balanced data set, a detoxification model is fine-tuned and trained to obtain a detoxified model. The present invention can reduce the poisoned samples of training data, avoid learning and fitting the features of backdoor triggers during model training, and improve the stability of the model's backdoor attack defense effect and the reliability of the model in practical applications.

Description

Technical Field

[0001] The present invention relates to the field of machine learning, and in particular to a data balancing detoxification method based on generative adversarial network data decoupling. Background Art

[0002] With the widespread application of deep neural network models (DNN) in fields such as computer vision, the security of models has received increasing attention. Backdoor attacks have become a serious threat to models. Backdoor attacks implant backdoor triggers during the model training phase, causing the model to misclassify when the backdoor trigger appears at the prediction node. Backdoor attacks are extremely concealed and have no obvious impact on the normal function of the model. Once the backdoor trigger appears, a preset error output will be generated, thereby achieving the attacker's purpose.

[0003] Existing backdoor defense mainly includes adversarial training, model repair and anomaly detection. These methods have problems such as high computational cost, strong dependence on attack methods, and high false positive rate in practical applications. In addition, other backdoor defense methods, such as those based on model fine-tuning and feature separation, can improve the robustness of the model to a certain extent, but their computational complexity is high, resulting in long training time and consumption of a large amount of computing resources; there are also backdoor defense methods based on static feature analysis, which rely on the detection of specific features or patterns and are easily bypassed by attackers. They cannot identify dynamically changing backdoor attacks, resulting in low backdoor attack recognition accuracy. Therefore, how to reduce the poisoned samples in the training data and avoid learning and fitting the features of the backdoor trigger during the model training process is of great significance to providing more effective and universal backdoor attack defense methods. Summary of the invention

[0004] In order to avoid the imbalance of the ratio of normal samples and poisoned samples in the training data due to the inclusion of poisoned samples in the training data, so that the model learns to fit the characteristics of the backdoor trigger during the training process, and reduces the stability of the model's backdoor attack defense effect and the reliability of the model in practical applications, the present invention provides a data balance detoxification method based on generative adversarial network data decoupling, the method comprising the following steps:

[0005] Perform dimensionality reduction mapping and cluster analysis on the data set to obtain several data clusters; add adversarial perturbations to each data cluster to generate adversarial data clusters;

[0006] Calculate the transfer rate and remove poisoned samples for each adversarial data cluster to obtain a detoxified data cluster, and combine all the detoxified data clusters into a detoxified data set; perform data decoupling and balancing processing on the detoxified data set to obtain a balanced data set;

[0007] Based on the balanced data set, the detoxification model is fine-tuned and trained to obtain a detoxification model.

[0008] Preferably, the data set is subjected to dimensionality reduction mapping and cluster analysis to obtain a number of data clusters, specifically:

[0009] Perform t-SNE dimensionality reduction processing on the data set to map the data set into a two-dimensional space;

[0010] Based on the K-means algorithm, cluster analysis is performed on the mapping results of the data set in the two-dimensional space to obtain several data clusters.

[0011] Preferably, the data set is subjected to t-SNE dimensionality reduction processing to map the data set to a two-dimensional space, specifically:

[0012] Setting the perplexity and number of iterations of the t-SNE algorithm, and calculating the similarity between samples of the data set in a high-dimensional space by the t-SNE algorithm;

[0013] The data set is mapped to a two-dimensional space while retaining the similarity in the two-dimensional space, thereby generating a point cloud image as a mapping result of the data set in the two-dimensional space.

[0014] Preferably, adding adversarial disturbance to each data cluster to generate adversarial data clusters is specifically as follows:

[0015] Generate adversarial perturbations corresponding to all samples in the data set through the FGSM algorithm;

[0016] Then add corresponding adversarial perturbations to all samples in each data cluster to generate adversarial data clusters.

[0017] Preferably, the step of adding corresponding adversarial disturbances to all samples in each data cluster to generate adversarial data clusters is specifically as follows:

[0018] The gradients of all samples in each data cluster are calculated. Based on the gradient direction of each sample, corresponding adversarial perturbations are added to all samples in each data cluster to generate adversarial data clusters.

[0019] Preferably, the transfer rate calculation and poisoned sample removal are performed on each adversarial data cluster to obtain a detoxified data cluster, specifically:

[0020] Calculate the transfer rate of all samples in each adversarial data cluster;

[0021] Based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, so as to remove the poisoned samples and obtain the detoxified data cluster.

[0022] Preferably, based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, thereby removing the poisoned samples to obtain a detoxified data cluster, specifically:

[0023] The transfer rate is compared with a preset transfer rate threshold, and if the transfer rate is less than the preset transfer rate threshold, it is determined that the corresponding sample in the adversarial data cluster is a poisoned sample; otherwise, it is determined that the corresponding sample in the adversarial data cluster is not a poisoned sample;

[0024] All poisoned samples in the adversarial data cluster are removed to obtain a detoxified data cluster.

[0025] Preferably, the detoxified data set is subjected to data decoupling and balancing processing to obtain a balanced data set, specifically:

[0026] The generative adversarial network is trained, and the detoxified data set is subjected to data decoupling and balancing processing by using the trained generative adversarial network to obtain a balanced data set.

[0027] Preferably, the generative adversarial network is trained, and the detoxified data set is subjected to data decoupling and balancing processing by the trained generative adversarial network to obtain a balanced data set, specifically:

[0028] Initializing a generator and a discriminator of a generative adversarial network, and generating fake samples similar to real samples of the detoxified data set through the generator and the discriminator;

[0029] Introducing a feature decoupling module into the generator and the classifier, analyzing the fake samples through the feature decoupling module, identifying and separating different types of features, and alternately training the generator and the classifier to optimize the objective function;

[0030] Based on the optimized objective function, it is determined whether the generative adversarial network has completed training; if so, a number of non-poisoned samples are generated using the generative adversarial network that has completed training, thereby obtaining a balanced data set.

[0031] Preferably, the method uses the trained generative adversarial network to generate a number of non-poisoned samples to obtain a balanced data set, specifically:

[0032] For all generated non-poisoned samples, the inter-class distance is increased and the intra-class distance is reduced to obtain a balanced data set.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] Perform dimensionality reduction mapping and cluster analysis on the data set to obtain several data clusters; add adversarial perturbations to each data cluster to generate adversarial data clusters. By reducing the dimensionality of the samples in the data set to a two-dimensional space, high-dimensional data can be mapped to a low-dimensional space while maintaining the local structure of the data; samples of different categories form different clusters in the two-dimensional space, thereby realizing cluster analysis of the samples. And on the basis of cluster analysis, add a certain amount of adversarial perturbations to each data cluster, where adversarial perturbations are small perturbations that can change the prediction results of the model without changing the visual effect of the sample.

[0035] The transfer rate of each adversarial data cluster is calculated and the poisoned samples are removed to obtain the detoxified data cluster, and all the detoxified data clusters are combined into a detoxified data set; the detoxified data set is processed by data decoupling and balancing to obtain a balanced data set. Suspicious poisoned samples are identified by calculating the transfer rate of samples in the adversarial data cluster. In the data decoupling and balancing stage, the generator and discriminator of the generative adversarial network GANs are initialized, the capabilities of the generator and discriminator are optimized through adversarial training, the feature decoupling module is used to analyze the generated samples, the features of different categories are separated, and the classifier is introduced to classify the generated samples, and the feedback generator is adjusted. A reward and punishment mechanism is also introduced to optimize the feature decoupling module, and feature decoupling is achieved by optimizing the objective function, which is used to generate a balanced data set, remove noise and enhance the generalization ability of the model. By separating and independently processing different features in the data set, the mutual interference between features is reduced and the training effect of the model is improved. Through the adversarial process between the generator and discriminator of the generative adversarial network, new samples are generated to balance the ratio of poisoned samples and normal samples, preventing the features of the backdoor trigger from being learned and fitted during the model training process.

[0036] Based on the balanced data set, the detoxification model is fine-tuned and trained to obtain the detoxification model. The proportion of poisoned samples in the balanced data set is reduced, so that when the detoxification model is trained using the balanced data set, the phenomenon of the model learning to fit the features of the backdoor trigger is reduced, and the possibility of backdoor poisoning in the model is reduced.

[0037] In general, the data balancing and detoxification method based on generative adversarial network data decoupling of the present invention has the following advantages: first, the high-dimensional data of the data set is reduced to a two-dimensional space to ensure that the data set contains clean samples and poisoned samples, accurately reflecting the true distribution of samples within the data set; the samples after dimensionality reduction are clustered and divided to improve the ability to observe the clustering of data set categories; second, a small adversarial perturbation is introduced by using an algorithm based on gradient-generated adversarial samples, and adversarial samples are generated by calculating the gradient of each sample and adding perturbations, observing the clustering changes before and after the addition of the adversarial perturbation, and setting a transfer rate threshold to screen out the clusters where the suspected poisoned samples are located for subsequent training of data set sample balance; Third, by initializing the generator and discriminator of the generative adversarial network (GANs), introducing a feature decoupling module, separating features of different categories, and optimizing the feature decoupling module in combination with a reward and punishment mechanism, the diversity and accuracy of generated samples are improved; by using the generative adversarial network (GANs) training to continuously optimize the ability of generated samples and real samples, a large number of non-poisoned samples are generated, and then a balanced data set is obtained, which significantly reduces the proportion of poisoned samples; Fourth, by calculating the center points of different categories, the inter-class distance and intra-class distance of all generated non-poisoned samples are increased, and the intra-class distance is reduced. The objective function is optimized by combining the inter-class distance and the intra-class distance to reduce the phenomenon of model learning to fit the features of the backdoor trigger, thereby reducing the possibility of backdoor poisoning in the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0039] Figure 1 It is a flow chart of the data balancing detoxification method based on generative adversarial network data decoupling provided by the present invention. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only the parts related to the present invention rather than all structures are shown in the accompanying drawings. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0041] The terms "including" and "having" and any variations thereof in the present invention are intended to cover non-exclusive inclusions. For example, a process, method, method, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0042] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0043] See also Figure 1 As shown, the present invention provides a data balancing detoxification method based on generative adversarial network data decoupling, the method comprising the following steps:

[0044] S100, performing dimensionality reduction mapping and cluster analysis on the data set to obtain a number of data clusters; adding adversarial perturbations to each data cluster to generate adversarial data clusters.

[0045] Furthermore, the data set is subjected to dimensionality reduction mapping and cluster analysis to obtain several data clusters, specifically:

[0046] Perform t-SNE dimensionality reduction on the data set and map the data set to a two-dimensional space;

[0047] Based on the K-means algorithm, cluster analysis is performed on the mapping results of the data set in two-dimensional space to obtain several data clusters.

[0048] Furthermore, the data set is processed by t-SNE dimensionality reduction to map the data set into a two-dimensional space, specifically:

[0049] Set the perplexity and number of iterations of the t-SNE algorithm, and use the t-SNE algorithm to calculate the similarity between samples of the data set in high-dimensional space;

[0050] The data set is mapped to a two-dimensional space while retaining the similarity in the two-dimensional space, thereby generating a point cloud map as the mapping result of the data set in the two-dimensional space.

[0051] In actual operation, the data set includes a large number of high-dimensional samples, including clean samples and poisoned samples, so as to ensure that the data after dimensionality reduction can accurately reflect the real distribution of the samples. Preferably, the t-SNE dimensionality reduction algorithm can be used to reduce the dimensionality of the data set. Accordingly, the t-SNE dimensionality reduction algorithm can be expressed by the following formula:

[0052]

[0053] In the above formula, is the similarity between sample i and sample j in high-dimensional space, is the similarity between sample i and sample j in a low-dimensional space (such as a two-dimensional space), and min represents the minimum value. The t-SNE dimensionality reduction algorithm is a commonly used data dimensionality reduction processing method in this field, which will not be described in detail here.

[0054] The parameters of the t-SNE dimensionality reduction algorithm directly affect the stability and accuracy of the dimensionality reduction process of the data set. The perplexity and number of iterations of the t-SNE dimensionality reduction algorithm are key and important parameters. Perplexity is used to measure the number of sample neighbors considered for each sample point during the dimensionality reduction process, affecting the balance between local and global data structures. After many dimensionality reduction practices, the perplexity is set to 40 and the number of iterations is set to 1000, which can achieve a good balance between local and global data structures, suitable for the visualization needs of most data sets, and effectively improve the stability and accuracy of dimensionality reduction results.

[0055] After executing the t-SNE dimensionality reduction algorithm, the dimensionality reduction result of the corresponding mapping of the two-dimensional space is obtained, which can be used in the following formula:

[0056]

[0057] In the above formula, is the similarity between sample i and sample j in low-dimensional space (such as two-dimensional space), yi and yj are the coordinates of sample i and sample j in low-dimensional space, yk and yl are the coordinates of sample k and sample l in high-dimensional space.

[0058] As can be seen from the above formula, the t-SNE dimensionality reduction algorithm calculates the similarities between sample points in high-dimensional space and retains these similarities in two-dimensional space to generate a point cloud map. Using a point cloud map in two-dimensional space to display the distribution of sample points makes it easy to visually observe the aggregation of samples of different categories. Among them, the point cloud map can help identify potential poisoning sample clusters.

[0059] The K-means algorithm is selected to perform cluster analysis on the mapping results of the data set in two-dimensional space after dimensionality reduction mapping, so as to observe the clustering of the data set categories by the model. Specifically, the K-means algorithm clusters by minimizing the distance from the sample point to the center of the cluster to which it belongs, which can be expressed by the following formula:

[0060]

[0061] In the above formula, is the probability that sample i belongs to the kth class, are the coordinates of the center point of the kth class, xi are the coordinates of sample i in the low-dimensional space, n is the total number of samples, K is the total number of clusters, || ||2 is the distance operation between two points, and min means taking the minimum value; the K-means algorithm is a commonly used clustering algorithm in this field and will not be described in detail here.

[0062] Since poisoned samples have latent features, they are usually clustered into the target category of the attack.

[0063] Furthermore, adversarial perturbations are added to each data cluster to generate adversarial data clusters, specifically:

[0064] Generate adversarial perturbations corresponding to all samples in the data set through the FGSM algorithm;

[0065] Then add corresponding adversarial perturbations to all samples in each data cluster to generate adversarial data clusters.

[0066] Furthermore, corresponding adversarial perturbations are added to all samples in each data cluster to generate adversarial data clusters, specifically:

[0067] The gradients of all samples in each data cluster are calculated. Based on the gradient direction of each sample, corresponding adversarial perturbations are added to all samples in each data cluster to generate adversarial data clusters.

[0068] By adding small adversarial perturbations to the samples, we can observe the changes in clustering. Specifically,

[0069] The fast gradient sign method (FGSM), an algorithm based on gradient-generated adversarial samples, is used to generate and add adversarial perturbations. The initial perturbation strength ε is selected, the gradient of each sample is calculated, and perturbations are added according to the gradient direction to generate adversarial samples, which can be expressed by the following formula:

[0070]

[0071] In the above formula, xadv is the adversarial sample, x is the original sample, ε is the initial perturbation strength, J is the loss function, θ is the model parameter, and y is the label. is the gradient of the original sample x, and sign is the FGSM operation sign.

[0072] Then, according to the gradient direction of the sample, the corresponding adversarial perturbation is added to all samples in each data cluster to generate adversarial data clustering. The clustering results before and after adding the adversarial perturbation are compared to evaluate the effect of the adversarial perturbation.

[0073] S200, calculate the transfer rate and remove poisoned samples for each adversarial data cluster to obtain a detoxified data cluster, and combine all the detoxified data clusters into a detoxified data set; perform data decoupling and balancing processing on the detoxified data set to obtain a balanced data set.

[0074] Furthermore, the transfer rate of each adversarial data cluster is calculated and the poisoned samples are removed to obtain the detoxified data cluster, which is as follows:

[0075] Calculate the transfer rate of all samples in each adversarial data cluster;

[0076] Based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, and then the poisoned samples are removed to obtain the detoxified data cluster.

[0077] Furthermore, based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, and the poisoned samples are removed to obtain the detoxified data cluster, specifically:

[0078] The transfer rate is compared with a preset transfer rate threshold. If the transfer rate is less than the preset transfer rate threshold, it is determined that the corresponding sample in the adversarial data cluster is a poisoned sample; otherwise, it is determined that the corresponding sample in the adversarial data cluster is not a poisoned sample;

[0079] All poisoned samples in the adversarial data clustering are removed to obtain the detoxified data clustering.

[0080] The transfer rate refers to the ratio of sample categories to other categories after adding adversarial perturbations. By calculating the category changes of samples before and after adding adversarial perturbations, the transfer rate is calculated using the following formula:

[0081]

[0082] In the above formula, TR is the transfer rate, NST is the number of sample changes after adding adversarial perturbations, and TNS is the total number of samples.

[0083] Then set a preset transfer rate threshold δ, where δ can be but is not limited to 80%, to screen the category of the suspected poisoned samples. Specifically, if the transfer rate is less than the preset transfer rate threshold, it is determined that the corresponding sample in the adversarial data cluster belongs to the poisoned sample; otherwise, it is determined that the corresponding sample in the adversarial data cluster does not belong to the poisoned sample, and all poisoned samples in the adversarial data cluster are removed to obtain the detoxified data cluster, thereby improving the removal accuracy of the suspected poisoned samples.

[0084] Furthermore, the detoxified data set is subjected to data decoupling and balancing to obtain a balanced data set, specifically:

[0085] The generative adversarial network is trained, and the detoxification data set is decoupled and balanced by the trained generative adversarial network to obtain a balanced data set.

[0086] Furthermore, the generative adversarial network is trained, and the detoxification data set is decoupled and balanced by the trained generative adversarial network to obtain a balanced data set, specifically:

[0087] Initialize the generator and discriminator of the generative adversarial network, and generate fake samples similar to the real samples of the detoxified data set through the generator and discriminator;

[0088] Introducing feature decoupling modules into the generator and classifier, the feature decoupling modules are used to analyze fake samples, identify and separate different types of features, and train the generator and classifier alternately to optimize the objective function.

[0089] Based on the optimized objective function, it is determined whether the generative adversarial network has completed training; if so, the trained generative adversarial network is used to generate several non-poisoned samples to obtain a balanced data set.

[0090] In the process of data decoupling and balancing, the generator G and discriminator D of the generative adversarial network are first initialized. The generator G is responsible for generating fake samples, and the discriminator D is responsible for distinguishing fake samples from real samples. The two are continuously optimized through adversarial training. The goal of the generator G is to minimize the difference between the generated samples and the real samples. The objective function of the generator is as follows:

[0091]

[0092] The objective function of the discriminator D as follows:

[0093]

[0094] In the above two formulas, z is a random vector sampled from the noise distribution, and x is a real sample;

[0095] The generated fake samples are analyzed by the feature decoupling module to identify and separate the features of different categories. The feature decoupling module can be implemented by introducing a classifier C, which is responsible for classifying the generated samples and feeding back to the generator G for adjustment. The objective function of the classifier C is as follows:

[0096]

[0097] In the above formula, yk is the category of sample x, and K is the total number of categories.

[0098] A reward and punishment mechanism is also introduced to optimize the feature decoupling module. Specifically, the loss function Ldecouple of the feature decoupling module is as follows:

[0099]

[0100] In the above formula, is the distribution of the real samples, is the noise distribution, is the fake sample generated by the generator G, is the classification result of the classifier C for the sample x, and λ is the weight coefficient of the gradient reward and penalty term.

[0101] The optimized generator G generates new fake samples, and the discriminator D discriminates the samples. The objective function is optimized by alternately training the generator G and the discriminator D. The training steps of the generator G and the discriminator D are as follows:

[0102] (1) From the noise distribution Sample random noise z and category label y;

[0103] (2) Use generator G to generate fake samples ;

[0104] (3) Update the parameters of the discriminator D to maximize the ability to distinguish between real samples and fake samples, as shown in the following formula:

[0105]

[0106] (4) Update the parameters of the generator G to minimize the probability that the generated sample is judged as false, as shown in the following formula:

[0107] .

[0108] The training process of the generator G and the discriminator D is a conventional method in the art and will not be described in detail here. A large number of non-poisoned samples are generated by the trained generative adversarial network, thereby obtaining a balanced data set, which significantly reduces the proportion of poisoned samples.

[0109] Furthermore, the trained generative adversarial network is used to generate several non-poisoned samples to obtain a balanced data set, specifically:

[0110] For all generated non-poisoned samples, the inter-class distance is increased and the intra-class distance is reduced to obtain a balanced data set.

[0111] After generating non-poisoned samples, the center points of different categories are calculated to pull the center points of different categories apart and increase the distance between classes. The goal of class distance optimization is to distribute samples of different categories more dispersedly in a low-dimensional space (such as a two-dimensional space) so that they are easier to distinguish.

[0112] By minimizing the distance between the samples within a class and the center point of its class, the goal is to make the same class more concentrated in a low-dimensional space (such as a two-dimensional space), thereby reducing the intra-class differences. Combining the inter-class distance and the intra-class distance, an optimization objective function is constructed for optimization. Minimizing the distance between the samples within a class and the center point of its class can be expressed by the following formula:

[0113]

[0114] In the above formula, dintra is the intra-class distance, is the coordinate of the center point of the kth class, is the coordinate of sample i in the low-dimensional space, and n is the total number of samples.

[0115] The purpose of optimizing the objective function is to maximize the inter-class distance and minimize the intra-class distance at the same time, so as to improve the model's ability to learn detoxified data, reduce the phenomenon of the model learning to fit the features of the backdoor trigger, and reduce the possibility of the model being backdoor poisoned. The optimization objective function obj can be expressed as follows:

[0116]

[0117] In the above formula, and are weight coefficients, and is the coordinate of the center point of the kth class, is the coordinate of sample i in the low-dimensional space, n is the total number of samples, and K is the total number of clusters.

[0118] S300, based on the balanced data set, fine-tuning the detoxification model to obtain the detoxification model.

[0119] Use a balanced dataset to fine-tune the detoxification model to ensure that the proportion of poisoned samples in the balanced dataset is reduced, thereby ultimately ensuring that backdoor poisoning will not occur after model training, thereby improving the robustness and security of the model.

[0120] Through the description of the above implementation methods, technicians in this field can clearly understand that each implementation method can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a computer product, and the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it, and other embodiments may also be used. Although the present invention has been described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or replace some of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data balancing detoxification method based on generative adversarial network data decoupling, characterized in that: The method comprises the following steps: Perform dimensionality reduction mapping and cluster analysis on the data set to obtain several data clusters; add adversarial perturbations to each data cluster to generate adversarial data clusters; Calculate the transfer rate and remove poisoned samples for each adversarial data cluster to obtain a detoxified data cluster, and combine all the detoxified data clusters into a detoxified data set; perform data decoupling and balancing processing on the detoxified data set to obtain a balanced data set; Based on the balanced data set, the detoxification model is fine-tuned and trained to obtain a detoxification model.

2. The method according to claim 1, characterized in that The data set is subjected to dimensionality reduction mapping and cluster analysis to obtain several data clusters, specifically: Perform t-SNE dimensionality reduction processing on the data set to map the data set into a two-dimensional space; Based on the K-means algorithm, cluster analysis is performed on the mapping results of the data set in the two-dimensional space to obtain several data clusters.

3. The method according to claim 2, characterized in that The t-SNE dimension reduction process is performed on the data set to map the data set to a two-dimensional space, specifically: Setting the perplexity and number of iterations of the t-SNE algorithm, and calculating the similarity between samples of the data set in a high-dimensional space by the t-SNE algorithm; The data set is mapped to a two-dimensional space while retaining the similarity in the two-dimensional space, thereby generating a point cloud image as a mapping result of the data set in the two-dimensional space.

4. The method according to claim 1, characterized in that: The adversarial perturbation is added to each data cluster to generate adversarial data clusters, specifically: Generate adversarial perturbations corresponding to all samples in the data set through the FGSM algorithm; Then add corresponding adversarial perturbations to all samples in each data cluster to generate adversarial data clusters.

5. The method according to claim 4, characterized in that The corresponding adversarial perturbation is added to all samples in each data cluster to generate adversarial data clusters, specifically: The gradients of all samples in each data cluster are calculated. Based on the gradient direction of each sample, corresponding adversarial perturbations are added to all samples in each data cluster to generate adversarial data clusters.

6. The method according to claim 1, characterized in that The transfer rate calculation and poisoned sample removal are performed on each adversarial data cluster to obtain a detoxified data cluster, specifically: Calculate the transfer rate of all samples in each adversarial data cluster; Based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, so as to remove the poisoned samples and obtain the detoxified data cluster.

7. The method according to claim 6, characterized in that Based on the transfer rate, the poisoned samples in each adversarial data cluster are identified, thereby removing the poisoned samples to obtain a detoxified data cluster, specifically: The transfer rate is compared with a preset transfer rate threshold, and if the transfer rate is less than the preset transfer rate threshold, it is determined that the corresponding sample in the adversarial data cluster is a poisoned sample; otherwise, it is determined that the corresponding sample in the adversarial data cluster is not a poisoned sample; All poisoned samples in the adversarial data cluster are removed to obtain a detoxified data cluster.

8. The method according to claim 1, characterized in that The detoxified data set is subjected to data decoupling and balancing processing to obtain a balanced data set, specifically: The generative adversarial network is trained, and the detoxified data set is subjected to data decoupling and balancing processing by using the trained generative adversarial network to obtain a balanced data set.

9. The method according to claim 8, characterized in that The generative adversarial network is trained, and the detoxified data set is subjected to data decoupling and balancing processing by the trained generative adversarial network to obtain a balanced data set, specifically: Initializing a generator and a discriminator of a generative adversarial network, and generating fake samples similar to real samples of the detoxified data set through the generator and the discriminator; Introducing a feature decoupling module into the generator and the classifier, analyzing the fake samples through the feature decoupling module, identifying and separating different types of features, and alternately training the generator and the classifier to optimize the objective function; Based on the optimized objective function, it is determined whether the generative adversarial network has completed training; if so, a number of non-poisoned samples are generated using the generative adversarial network that has completed training, thereby obtaining a balanced data set.

10. The method according to claim 9, characterized in that The trained generative adversarial network is used to generate several non-poisoned samples, thereby obtaining a balanced data set, specifically: For all generated non-poisoned samples, the inter-class distance is increased and the intra-class distance is reduced to obtain a balanced data set.

Images