A method, device and equipment for detecting attacks

Abstract

The present application provides an attack detection method, device and equipment, which relates to the field of computer security technology and is used to improve the universality of the attack detection method of the DNN model. The attack detection method includes: according to the sample trigger set and the preset clustering algorithm, the sample trigger set is classified and classified to obtain a sample trigger subset of multiple attack types; according to the sample trigger subset of each attack type in the multiple attack types, a scanner corresponding to each attack type is generated; according to the scanner corresponding to each attack type, the model to be detected is scanned in turn to obtain the scanning result, and the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger that attacks the model to be detected.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to an attack detection method, device and equipment. Background Art

[0002] As deep neural network (DNN) models are widely used in various high-risk industries, security protection of DNN models has become particularly important. A typical threat to DNN models is backdoor attacks during the training phase. The attacker injects a backdoor trigger of a specific pattern into some clean training data (or benign training data) and changes its label to the target label specified by the attacker. After the DNN model is trained with the training data injected with the backdoor trigger, the DNN model is attacked by the backdoor. This backdoor attack causes the DNN model to output the target label specified by the attacker when it detects an object that meets the conditions for triggering the backdoor trigger, resulting in an error in the result of the DNN model detecting the object.

[0003] In response to the above technical problems, a defense mechanism based on trigger inversion has been proposed. However, this defense mechanism requires a loss function to be designed separately for the attack details of each backdoor trigger. Generally, it can only be used to detect one backdoor trigger in a targeted manner, and is ineffective for other backdoor triggers, so its universality is low. Summary of the invention

[0004] The present application provides an attack detection method, apparatus and device for improving the universality of attack detection methods for DNN models.

[0005] In a first aspect, an embodiment of the present application provides an attack detection method, comprising: according to a sample trigger set and a preset clustering algorithm, summarizing and classifying the sample trigger set to obtain a plurality of sample trigger subsets of attack types; according to the sample trigger subsets of each attack type in the plurality of attack types, generating a scanner corresponding to each attack type; according to the scanner corresponding to each attack type, scanning the model to be detected in turn to obtain a scanning result, wherein the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger that attacks the model to be detected.

[0006] In an embodiment of the present application, a set of sample triggers is summarized and classified through a clustering algorithm to generate a scanner for each attack type. Compared with traditional defense mechanisms, the scanner for each attack type can identify a trigger for an attack type, and has better universality. Moreover, when detecting a model to be detected, the embodiment of the present application uses scanners of all attack types to perform a comprehensive scan on the model to be detected, which is beneficial to improving the accuracy of attack detection on the model to be detected.

[0007] In a possible implementation, before the sample trigger set is summarized and classified according to the sample trigger set and the preset clustering algorithm to obtain a plurality of attack type sample trigger subsets, the method further includes: performing a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample, wherein each attack sample is obtained by injecting a sample trigger into a clean sample; iteratively optimizing the initial sample trigger and the initial clean sample based on a pre-trained first sample reconstruction model and a preset infection model until a target sample trigger of each attack sample is obtained; wherein the first sample reconstruction model is used to iteratively optimize the initial clean sample based on the first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain an optimized sample trigger; the infection model is used to determine an error between the optimized sample trigger and the clean sample compared to a reference sample trigger and a reference clean sample based on a verification attack sample, wherein the verification attack sample is obtained by reconstructing the optimized sample trigger based on a second sample reconstruction operation, and the error is used to adjust a model parameter of the first sample reconstruction model until the target sample trigger is obtained; and the target sample trigger corresponding to each attack sample in the attack sample set is grouped into the sample trigger set.

[0008] In a possible implementation, based on a pre-trained first sample reconstruction model and a preset infection model, iteratively optimizing the initial sample trigger and the initial clean sample until a target sample trigger for each attack sample is obtained, including: performing the following operations on an attack sample in the attack sample set: based on the first sample reconstruction model, performing the first sample reconstruction operation on the first clean sample to obtain a second clean sample, the first clean sample being obtained by decomposing the attack sample based on the preset first sample trigger, and the error between the second clean sample and the reference clean sample being less than the error between the first clean sample and the reference clean sample; based on the second clean sample, decomposing the attack sample to obtain a second sample trigger, and the error between the second sample trigger and the reference sample trigger being less than the error between the first sample trigger and the reference sample trigger; performing the second sample reconstruction operation on the second sample trigger to obtain the verification attack sample; inputting the verification attack sample and the second clean sample into the infection model to obtain detection results for the verification attack sample and the second clean sample; based on the detection result, the second clean sample and the second sample trigger, in combination with a preset loss function, adjusting model parameters of the first sample reconstruction model until preset conditions are met to obtain the target sample trigger.

[0009] In a possible implementation, the trigger type includes a first type and a second type, the first type corresponds to a first decomposition algorithm, and the second type corresponds to a second decomposition algorithm; the initial sample trigger includes a first initial sample trigger and a second initial sample trigger, and the initial clean sample includes a first initial clean sample and a second initial clean sample; the iterative optimization of the initial sample trigger and the initial clean sample based on the pre-trained first sample reconstruction model and the preset infection model until the target sample trigger of each attack sample is obtained includes: iteratively optimizing the first initial sample trigger and the first initial clean sample based on the first sample reconstruction model and the infection model to obtain a third trigger, the first initial clean sample is obtained by decomposing each attack sample based on the first decomposition algorithm and the first initial sample trigger; iteratively optimizing the second initial sample trigger and the second initial clean sample based on the first sample reconstruction model and the infection model to obtain a fourth trigger, the second initial clean sample is obtained by decomposing each attack sample based on the second decomposition algorithm and the second initial sample trigger; determining a first attack success rate corresponding to the third trigger and a second attack success rate corresponding to the fourth trigger; and determining the trigger with a larger attack success rate between the third trigger and the fourth trigger as the target sample trigger of each attack sample.

[0010] In a possible implementation, generating a scanner corresponding to each attack type based on a subset of sample triggers for each attack type among the multiple attack types includes: determining a Gaussian distribution coefficient for each attack type based on a preset Gaussian distribution algorithm and the subset of sample triggers for each attack type; and generating a scanner for each attack type based on the Gaussian distribution coefficient.

[0011] In a possible implementation, the model to be detected is scanned in turn according to the scanner corresponding to each attack type to obtain a scanning result, including: according to the scanner corresponding to each attack type, the model to be detected is scanned in turn, if there is a first scanner that scans the target trigger from the model to be detected, it is determined that the model to be detected has been attacked, wherein the third attack success rate corresponding to the target trigger is greater than a preset threshold; the attack type corresponding to the first scanner is determined as the attack type of the target trigger, and a scanning result is generated.

[0012] In a second aspect, an embodiment of the present application provides an attack detection device, comprising: a classification module, used to summarize and classify the sample trigger set according to a sample trigger set and a preset clustering algorithm to obtain a sample trigger subset of multiple attack types; a generation module, used to generate a scanner corresponding to each attack type according to the sample trigger subset of each attack type in the multiple attack types; a scanning module, used to scan the model to be detected in turn according to the scanner corresponding to each attack type to obtain a scanning result, wherein the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger attacking the model to be detected.

[0013] In a possible implementation, the attack detection device further includes a decomposition module, which is used to: perform a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample, wherein each attack sample is obtained by injecting a sample trigger into a clean sample; iteratively optimize the initial sample trigger and the initial clean sample based on a pre-trained first sample reconstruction model and a preset infection model until a target sample trigger for each attack sample is obtained; wherein the first sample reconstruction model is used to iteratively optimize the initial clean sample based on a first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain an optimized sample trigger; the infection model is used to determine an error between the optimized sample trigger and the clean sample compared to a reference sample trigger and a reference clean sample based on a verification attack sample, wherein the verification attack sample is obtained by reconstructing the optimized sample trigger based on a second sample reconstruction operation, and the error is used to adjust the model parameters of the first sample reconstruction model until the target sample trigger is obtained; and the target sample trigger corresponding to each attack sample in the attack sample set is grouped into the sample trigger set.

[0014] In a possible implementation, the decomposition module is specifically used to: perform the following operations on an attack sample in the attack sample set: based on the first sample reconstruction model, perform the first sample reconstruction operation on the first clean sample to obtain a second clean sample, the first clean sample is obtained by decomposing the attack sample based on a preset first sample trigger, and the error between the second clean sample and the reference clean sample is less than the error between the first clean sample and the reference clean sample; based on the second clean sample, decompose the attack sample to obtain a second sample trigger, and the error between the second sample trigger and the reference sample trigger is less than the error between the first sample trigger and the reference sample trigger; perform the second sample reconstruction operation on the second sample trigger to obtain the verification attack sample; input the verification attack sample and the second clean sample into the infection model to obtain detection results for the verification attack sample and the second clean sample; based on the detection result, the second clean sample and the second sample trigger, in combination with a preset loss function, adjust the model parameters of the first sample reconstruction model until a preset condition is met to obtain the target sample trigger.

[0015] In a possible implementation, trigger types include a first type and a second type, the first type corresponds to a first decomposition algorithm, and the second type corresponds to a second decomposition algorithm; the initial sample trigger includes a first initial sample trigger and a second initial sample trigger, and the initial clean sample includes a first initial clean sample and a second initial clean sample; the decomposition module is specifically used to: iteratively optimize the first initial sample trigger and the first initial clean sample based on the first sample reconstruction model and the infection model to obtain a third trigger, the first initial clean sample is obtained by decomposing each attack sample based on the first decomposition algorithm and the first initial sample trigger; iteratively optimize the second initial sample trigger and the second initial clean sample based on the first sample reconstruction model and the infection model to obtain a fourth trigger, the second initial clean sample is obtained by decomposing each attack sample based on the second decomposition algorithm and the second initial sample trigger; determine a first attack success rate corresponding to the third trigger and a second attack success rate corresponding to the fourth trigger; determine the trigger with a larger attack success rate between the third trigger and the fourth trigger as the target sample trigger for each attack sample.

[0016] In a possible implementation, the generation module is specifically used to: determine the Gaussian distribution coefficient of each attack type according to a preset Gaussian distribution algorithm and a subset of sample triggers of each attack type; and generate a scanner for each attack type according to the Gaussian distribution coefficient.

[0017] In a possible implementation, the scanning module is specifically used to: scan the model to be detected in turn according to the scanner corresponding to each attack type; if there is a first scanner that scans the target trigger from the model to be detected, it is determined that the model to be detected has been attacked, wherein the third attack success rate corresponding to the target trigger is greater than a preset threshold; the attack type corresponding to the first scanner is determined as the attack type of the target trigger, and a scanning result is generated.

[0018] In a third aspect, an embodiment of the present application provides an attack detection device, comprising: at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method described in the first aspect and any possible implementation manner by executing the instructions stored in the memory.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and any possible implementation manner.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation method to be implemented.

[0021] The beneficial effects of the second to fifth aspects can be referred to the contents described in the first aspect above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of an application scenario of an attack detection method provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of an attack detection method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a process for decomposing an attack sample provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0028] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0029] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0030] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0031] Below, some terms or concepts in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0032] 1. Backdoor attack: refers to an attacker implanting a hidden backdoor in a system, application, or network so that normal authentication and security measures can be bypassed in the future to gain unauthorized access to the system or data. This type of attack usually occurs during software development or system configuration. The attacker may use vulnerabilities, malicious code, or other means to create a backdoor.

[0033] 2. Deep Neural Network (DNN): An artificial neural network composed of multiple layers of neurons. It is an important model in the field of machine learning and deep learning, which can make predictions and classifications by learning complex patterns and features in large amounts of data.

[0034] 3. Trigger: A mode used to activate the hidden backdoor.

[0035] 4. Benign samples (clean samples): clean samples without triggers.

[0036] 5. Attack samples (poisoned samples): malicious test samples that contain backdoor triggers.

[0037] 6. Target label: The label specified by the attacker. The attacker intends to make all attacked samples predicted as the target label by the infected model.

[0038] 7. Attack Success Rate (ASR): It indicates the proportion of attacked samples that are successfully predicted as target labels by the infected model.

[0039] 8. Generative Adversarial Network (GAN): It is a deep learning model consisting of two neural networks: the generator and the discriminator. The two networks are trained through an adversarial process. The goal of the generator is to generate samples that are as realistic as possible, while the goal of the discriminator is to distinguish between real samples and generated samples. After effective training, the generator is finally able to generate new data that is very similar to the distribution of real data.

[0040] Please refer to Figure 1 , is a schematic diagram of an application scenario of an attack detection method provided in an embodiment of the present application. Figure 1 As shown, the schematic diagram includes a device 110 and an attack detection apparatus 120. A model to be detected 111 is also running in the device 110. The device 110 and the attack detection apparatus 120 can perform wired or wireless communication.

[0041] Among them, the device 110 may refer to a device that can support the operation of the model to be detected 111, such as a terminal device or a server, and the terminal device includes but is not limited to a mobile phone, a personal computer (PC), a tablet computer, a laptop computer, a PDA, a mobile Internet device (MID), etc. The model to be detected 111 is, for example, a DNN model. The attack detection device 120 may refer to a device or apparatus with data processing capabilities. When the attack detection device 120 is a device with data processing capabilities, it may specifically be a functional module in a device, such as a functional module in the device 110, and the embodiments of the present application are not limited to this.

[0042] Exemplarily, the device 110 runs a model 111 to be detected. Before the attack detection device 120 performs an attack detection operation on the model 111 to be detected, it can first classify the sample trigger set according to the sample trigger set and the preset clustering algorithm to obtain a subset of sample triggers of multiple attack types; and generate a scanner corresponding to each attack type according to the subset of sample triggers of each attack type in the multiple attack types. Finally, the attack detection device 120 can scan the model 111 to be detected in turn according to the scanner corresponding to each attack type to obtain a scanning result. Among them, the specific implementation method of the attack detection device generating a scanner for each attack type and using the scanner for each attack type to scan the model 111 to be detected will be described in detail below.

[0043] Please refer to Figure 2 , is a flow chart of an attack detection method provided in an embodiment of the present application. The following is a flow chart of an attack detection method performed by an attack detection device. Figure 2 The steps shown are illustrated by way of example. Figure 1 The attack detection device 120 is shown. Figure 2 The models to be tested are, for example, Figure 1 The model to be detected 111 is shown.

[0044] S201, classifying the sample trigger set according to the sample trigger set and a preset clustering algorithm to obtain sample trigger subsets of multiple attack types.

[0045] The sample trigger set may be pre-existing in the attack detection device. Alternatively, each sample trigger in the sample trigger set is obtained by the attack detection device from decomposing an attack sample set, the attack sample set may be collected in advance from various attack instances, and each attack sample in the attack sample set is obtained by the attacker injecting the sample trigger into a clean sample. The specific manner in which the attack detection device decomposes the sample trigger set from the attack sample set is described in detail below.

[0046] The attack detection device can perform a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample. Based on the pre-trained first sample reconstruction model and the preset infection model, the initial sample trigger and the initial clean sample are iteratively optimized until the target sample trigger of each attack sample is obtained. Among them, the first sample reconstruction model is used to iteratively optimize the initial clean sample based on the first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain the optimized sample trigger. The infection model is used to determine the error between the optimized sample trigger and the clean sample compared with the reference sample trigger and the reference clean sample according to the verification attack sample, and the error is used to adjust the model parameters of the first sample reconstruction model until the target sample trigger is obtained. Among them, the verification attack sample is obtained by reconstructing the optimized sample trigger based on the second sample reconstruction operation, and the initial sample trigger is a sample trigger predefined by the user. Finally, the attack detection device can group the target sample trigger corresponding to each attack sample in the attack sample set into a sample trigger set.

[0047] Exemplarily, the first sample reconstruction model is a pre-trained GAN. The infection model is a DNN model that has been attacked by a backdoor.

[0048] In order to more clearly illustrate the process of the attack detection device decomposing each attack sample in the attack sample set to obtain the target sample trigger, the following takes an attack sample as an example. Figure 3 A flowchart of decomposing an attack sample is shown to illustrate this in detail.

[0049] S301: The attack detection apparatus performs a decomposition operation on an attack sample based on a first sample trigger to obtain a first clean sample.

[0050] The first sample trigger corresponds to the initial sample trigger mentioned above, and the initial sample trigger is a predefined sample trigger. The first clean sample corresponds to the initial clean sample mentioned above.

[0051] S302, the attack detection device inputs the first clean sample into the first sample reconstruction model, and based on the first sample reconstruction model, performs the first sample reconstruction operation on the first clean sample to obtain a second clean sample, wherein the error between the second clean sample and the reference clean sample is less than the error between the first clean sample and the reference clean sample.

[0052] Since the first sample reconstruction model is a pre-trained GAN model, the first clean sample is reconstructed by the pre-trained GAN, so that the reconstructed second clean sample is more consistent with the real data distribution. The operation of GAN reconstructing the first clean sample is the first sample reconstruction operation.

[0053] S303: The attack detection device performs a decomposition operation on the one attack sample based on the second clean sample to obtain a second sample trigger.

[0054] Since the second clean sample is a clean sample reconstructed by the first sample reconstruction model, its data distribution is more consistent with the reference clean sample than the first clean sample. Therefore, the attack detection device performs a decomposition operation on the attack sample again based on the second clean sample to obtain a second sample trigger. The second sample trigger is more consistent with the reference sample trigger than the first sample trigger. In other words, the error between the second sample trigger and the reference sample trigger is smaller than the error between the first sample trigger and the reference sample trigger.

[0055] S304: The attack detection device performs a second sample reconstruction operation on the second sample trigger to obtain a verification attack sample.

[0056] Specifically, the attack detection device can inject the second sample trigger into the preset verification clean sample to obtain the first verification attack sample, and inject the second sample trigger into the second clean sample to obtain the second verification attack sample. It should be understood that the verification attack sample described in S304 includes the first verification attack sample and the second verification attack sample.

[0057] S305, the attack detection device inputs the verified attack sample and the second clean sample into the infection model to obtain detection results for the verified attack sample and the second clean sample.

[0058] The detection result includes the detection result of the infection model on the verification attack sample and the detection result on the second clean sample.

[0059] S306: The attack detection device determines whether the loss value meets a preset condition based on the detection result, the second clean sample and the second sample trigger in combination with a preset first loss function.

[0060] Among them, the preset condition may refer to a convergence condition, for example, the loss value reaches a preset threshold. The preset threshold may be set according to actual needs, such as 0.2, and the embodiment of the present application does not limit this.

[0061] The loss value can be calculated according to a preset verification function (i.e., the first loss function). The purpose of the verification function is to ensure that the verification attack sample is incorrectly detected as the target label, and to ensure that the decomposed clean sample is correctly detected as the true label. In other words, if the decomposed second sample trigger is accurate enough, then the infection model's detection result for the verification attack sample should be the target label. If the decomposed second clean sample is accurate enough, then the infection model's detection result for the second clean sample should be the true label.

[0062] Among them, the verification function is shown in the following formula 1:

[0063] Formula 1

[0064] in, represents the cross entropy loss, M(•) represents the output of the infection model (i.e., the detection result), Indicates the user-defined attack target label, Represents the true label corresponding to the uncontaminated clean sample. Among them, the first and second terms in Formula 2 mean that the decomposed trigger (such as the second sample trigger) is valid for the clean sample. In other words, if the decomposed trigger is re-labeled on the clean sample and input into the infection model, the infection model should output the attack target label. The third term in Formula 2 means that the decomposed clean sample has successfully removed the contamination of the trigger. In other words, the infection model should predict the decomposed clean sample as its true label.

[0065] In this implementation, if the verification loss value does not decrease after multiple consecutive cycle decompositions (for example, 20 rounds), the training is terminated early and it is considered that the attack sample does not have a target sample trigger.

[0066] S307: If the loss value reaches a preset condition, the second sample trigger is determined as the target sample trigger, and the decomposition process ends.

[0067] S308, if it is determined that the loss value does not meet the preset conditions, then according to the detection results, the second clean sample and the second sample trigger, combined with the preset second loss function, adjust the model parameters of the first sample reconstruction model, and determine the second sample trigger as the first sample trigger, and repeat S301-S306 until the preset conditions are met to obtain the target sample trigger.

[0068] Among them, the preset objective function (i.e., the second loss function) is shown in the following formula 2:

[0069] Formula 2

[0070] Among them, L represents the loss value. The LPIPS loss reference is often used as a constraint in GAN-based input reconstruction. It is the sum of weighted differences of all layers, indicating the perceptual similarity of two samples. The weights are usually learned during the training process to reflect the contribution of different layers to the perceptual similarity. It can represent the input of the first sample reconstruction model, that is, a clean sample with errors, for example, the first clean sample. The output of the first sample reconstruction model may always represent the reconstructed clean sample, that is, the second clean sample. express norm, used to calculate the Euclidean distance between two inputs. The first term of Formula 3 ensures that the reconstructed clean sample Should be a clean image with the trigger removed Similar to GAN, the former ensures that it is in the input distribution. In this embodiment, StyleGAN trained with a large-scale training set is used to restore the clean samples after the trigger is released. The second item ensures that the reconstructed attack samples Should be the same as the original attack sample Similar. Among them, It represents the attack sample obtained after the decomposed sample trigger is injected into the reconstructed clean sample, for example, it is the second verification attack sample, Can be expressed based on The sample trigger is obtained after decomposing the attack sample. The original attack sample refers to the attack sample in the attack sample set.

[0071] Since the second sample trigger is more accurate than the previous first sample trigger, when repeated execution occurs, the second sample trigger obtained in the previous cycle is determined as the new first sample trigger, which can further make the clean sample obtained by decomposition more accurate, so that the target sample trigger can be obtained after iterations.

[0072] It should be noted that the attack detection device can correspond to Figure 3 The decomposition process shown decomposes each attack sample, obtains the target sample trigger corresponding to each attack sample, and groups the target sample trigger corresponding to each attack sample in the attack sample set into a sample trigger set.

[0073] In a possible implementation, the sample trigger corresponds to a trigger type, and the trigger type may include a first type and a second type, the first type corresponds to a first decomposition algorithm and a first injection algorithm, and the second type corresponds to a second decomposition algorithm and a second injection algorithm. The decomposition algorithm is used to decompose the attack sample to obtain a sample trigger or a clean sample, and the injection algorithm is used to inject the sample trigger into the clean sample to obtain the attack sample. The first type is, for example, a patch backdoor type, and the second type is, for example, a transformation backdoor type.

[0074] Exemplarily, taking the first type as an example, the first injection algorithm may be as shown in the following formula 3:

[0075] Formula 3

[0076] in, represents the injection operation, ⋅ represents element-wise multiplication, t represents the disturbance variable, which determines the disturbance value of the trigger, and m represents the mask variable, which determines the shape or position of the trigger.

[0077] The first decomposition algorithm can be expressed as follows:

[0078] Formula 4

[0079] in, Represents a decomposition operation.

[0080] The principles of the second decomposition algorithm and the second injection algorithm of the transform backdoor type trigger are similar to those of the patch backdoor type trigger, and will not be repeated here.

[0081] In this implementation, since the attack detection device does not know what type of sample trigger is injected into each attack sample, or what method is used to inject the sample trigger into the clean sample, when decomposing each attack sample to obtain the target sample trigger, the attack detection device needs to perform two decomposition operations for the first type of decomposition algorithm and the second type of decomposition algorithm respectively.

[0082] Specifically, the attack detection device decomposes each attack sample based on the first decomposition algorithm and the first initial sample trigger to obtain a first initial clean sample. Based on the first sample reconstruction model and the infection model, the first initial sample trigger and the first initial clean sample are iteratively optimized until a third trigger is obtained. In this process, when the second sample reconstruction operation is performed, the reconstruction of the verified attack sample can be realized based on the aforementioned first injection algorithm.

[0083] The attack detection device decomposes each attack sample based on the second decomposition algorithm and the second initial sample trigger to obtain a second initial clean sample. Based on the first sample reconstruction model and the infection model, the second initial sample trigger and the second initial clean sample are iteratively optimized until a fourth trigger is obtained. In this process, when the second sample reconstruction operation is performed, the reconstruction of the verified attack sample can be realized based on the aforementioned second injection algorithm.

[0084] The attack detection device determines a first attack success rate corresponding to the third trigger and a second attack success rate corresponding to the fourth trigger, respectively, and determines the trigger with a larger attack success rate between the third trigger and the fourth trigger as the target sample trigger for each attack sample.

[0085] The following takes the third trigger as an example to illustrate the method for calculating the first attack success rate calculated by the attack detection device.

[0086] The attack detection device injects the third trigger into some verification samples of the verification data set to obtain an attack verification data set and a clean verification data set, wherein the attack verification data set includes the verification samples after the third trigger is injected, and the clean verification data set includes the clean verification samples without the third trigger injected. The attack verification data set and the clean verification data set are input into the infection model to obtain the detection result of the infection model for each verification data. The attack detection device determines the number of attack samples successfully predicted as target labels by the infection model and the number of attack verification data sets in the detection result. Among them, if the infection model successfully predicts the attack sample as the target label, it means that the infection model is successfully attacked by the backdoor, and the target label output by it is the target label specified by the attacker. The attack detection device determines the first attack success rate of the third trigger as the proportion of the number of attack samples successfully predicted as target labels by the infection model to the number of all attack samples, that is, the first attack success rate = the number of attack samples predicted as target labels / the total number of attack samples.

[0087] The attack detection device determines the calculation method of the second attack success rate of the fourth trigger, which can correspond to the calculation method of the first attack success rate. The process of the attack detection device decomposing each attack sample to obtain the third trigger and the fourth trigger can correspond to the above Figure 3 The process described above will not be repeated here.

[0088] In this embodiment, when the trigger included in the attack sample is set to a patch backdoor type or a transformation backdoor type, after setting the first initial trigger or the second initial trigger, if the above-mentioned Figure 3 In the process described above, when the number of cyclic decompositions reaches a preset number and the verification loss value does not decrease, the decomposition process is terminated and it is considered that the attack sample does not have a trigger for the currently set patch backdoor type or the change backdoor type.

[0089] Since it is unclear what type of trigger the sample trigger injected into the attack sample is or how it is injected, in an embodiment of the present application, two decomposition operations are performed for each attack sample, and the final target sample trigger is determined based on the attack success rate corresponding to the trigger. The higher the attack success rate, the more accurate the sample trigger obtained by decomposition, which in turn improves the accuracy of determining the target sample trigger.

[0090] After obtaining the sample trigger set, the attack detection device can extract the attack feature vector of each sample trigger in the sample trigger set. Since different types of sample triggers correspond to different decomposition algorithms and injection algorithms, the extracted attack feature vectors are also different. For example, the attack feature vector corresponding to the first type of sample trigger is used as the decomposition mask. and decomposed triggers , the attack feature vector can be expressed as =[ ]. The attack feature vector corresponding to the second type of sample trigger is the decomposed weight and decomposed bias , the attack feature vector can be expressed as Therefore, the attack detection device can extract the attack feature vector of each sample trigger based on the decomposition algorithm and injection algorithm corresponding to the first type and the second type described above, which will not be described in detail here.

[0091] The attack detection device uses a clustering algorithm to classify the attack feature vector set to obtain a sample trigger subset of multiple attack types. The attack feature vector set includes the attack feature vector of each sample trigger in the sample trigger set, and the sample trigger subset specifically refers to the attack feature vector subset corresponding to the sample trigger subset.

[0092] For example, taking the K-means clustering algorithm as an example, the main steps of the K-means clustering algorithm are as follows:

[0093] 1) Select the K value: determine the number of clusters K to be divided.

[0094] 2) Initialize the center point: Randomly select K data points as the initial cluster center.

[0095] 3) Assign clusters: Calculate the distance between each data point and the cluster center and assign the data point to the nearest cluster center.

[0096] 4) Update the center point: Calculate the mean of all data points in each cluster and update the cluster center.

[0097] 5) Iteration: Repeat steps 3 and 4 until the cluster center no longer changes or the preset number of iterations is reached.

[0098] Combined with the above algorithm steps, the attack detection device sets the attack feature vector set of the sample trigger set , divided into k mutually disjoint subsets , where each subset represents an attack type.

[0099] It should be understood that the attack types classified according to the clustering algorithm are different from the first type and the second type mentioned above. It can be understood that the attack types classified according to the clustering algorithm are more detailed than the first type and the second type.

[0100] S202: Generate a scanner corresponding to each attack type according to a subset of sample triggers of each attack type in a plurality of attack types.

[0101] Specifically, the attack detection device may determine the Gaussian distribution coefficient of each attack type according to a preset Gaussian distribution algorithm and a sample trigger subset of each attack type.

[0102] For example, the Gaussian distribution coefficient of each attack type may be expressed as follows:

[0103] Formula 5

[0104] in, represents the i-th attack type, and represent The mean and variance vectors of .

[0105] Furthermore, the attack detection device generates a scanner corresponding to each attack type based on the Gaussian distribution coefficient, and the scanner needs to be trained using a preset loss function to implement the scanning process. The preset loss function of the scanner can be shown in the following formula 6:

[0106] Formula 6

[0107] in, represents the loss function of the scanner for the i-th attack type, represents a predefined target label, represents a clean sample, represents the test data set, represents the cross entropy loss, Represents the regularized loss term based on the Gaussian distribution coefficient.

[0108] The cross entropy loss is used to evaluate whether the output of the model to be detected is the target label under the trigger of a specific attack type. The definition of the cross entropy loss can be shown in the following formula 7:

[0109] Formula 7

[0110] Where C represents the number of categories in the data set. Indicates that the current sample belongs to the true label of the i-th category (0 means it does not belong to the i-th category, 1 means it belongs to the i-th category), Indicates the probability value of the current sample being predicted by the model as the i-th category. For each scanner, the preset target label It can be any one of the target label sets in the dataset. Therefore, for each scanner training, the target label set is traversed and a target label is selected. The training is carried out until a trigger that satisfies the conditions is inverted, and the current scanner training is terminated. For each round of training of a scanner that selects a target label, if the current trigger t satisfies the following conditions, the optimizer will complete a round and return. First, the attack success rate using trigger t needs to be greater than the threshold θ, and the current trigger must be smaller than the previous trigger. If the preset maximum number of iterations has been used up, the optimizer may return that the current optimization has failed, which means that there is no backdoor attack on the model for the current target label. If a target label is found to have a very small trigger (taking a patch type trigger as an example, its size can be calculated from the L1 norm of the mask m, and the smaller the value, the smaller the trigger) to achieve high ASR, it will be determined that the model has been attacked by a backdoor.

[0111] The regularization loss term is used to constrain the range of the inverted trigger eigenvalues ​​to ensure that the eigenvalues ​​are within the distribution range of known backdoor attacks. The definition of the regularization loss term can be shown in the following formula 8:

[0112] Formula 8

[0113] Among them, δ is the penalty coefficient. F represents the distribution range of the characteristic value of the inverted trigger. 1.04 corresponds to the standard deviation multiple between the 85th percentile and the 15th percentile in the Gaussian distribution, which ensures that the characteristic value of F falls within this expected range. When the value of F exceeds this range, a penalty is introduced. This penalty term encourages the optimization process to keep F within the expected range, thereby avoiding the influence of outliers in the trigger. In other words, the regularization loss term ensures that the scanner keeps the inverted trigger within the potential backdoor attack (such as ) within the expected distribution range (e.g. 15-85%), ultimately achieving control and constraint on the distribution of feature F.

[0114] S203, according to the scanner corresponding to each attack type, the model to be detected is scanned in turn to obtain a scanning result, and the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the template trigger that attacks the model to be detected.

[0115] Specifically, the attack detection device can take the training sample set, the target label set and the model to be detected as input, wherein the target label set includes the label set corresponding to the training sample set, and the training sample set and the target label set are both predefined by the user. When using scanner i to scan the model to be detected, first select a target label from the target label set, and initialize the inversion trigger according to the attack type corresponding to scanner i. , the initial loss function is obtained by calculating formula 6. The trigger t for initialization inversion can be pre-set or randomly inverted based on the trigger parameters of the attack type corresponding to the scanner i mentioned above. Taking the trigger of the patch backdoor type as an example, its trigger parameters include the trigger parameters mentioned above. and , which is not limited in the embodiments of the present application. Secondly, in order to reduce the loss value, the scanner will automatically adjust the parameters of the trigger t to optimize the loss function. The expected effect is that with each round of training of the scanner i, the loss value calculated by formula 6 will continue to decrease until convergence. Finally, a trigger t that meets the requirements will be obtained for the scanner i. During the scanning process of the model to be detected, the attack detection device can scan the model to be detected in turn according to the scanner corresponding to each attack type. If there is a first scanner that scans the target trigger from the model to be detected, it is determined that the model to be detected has been attacked. Among them, the third attack success rate corresponding to the target trigger is greater than the preset threshold, and the preset threshold can be set according to actual needs, for example, 70%, which is not limited in the embodiments of the present application. The attack detection device determines the attack type corresponding to the first scanner as the attack type of the target trigger, and generates a scanning result. If the scanners corresponding to all attack types have completed the scanning of the model to be detected, but have not detected the target trigger that meets the conditions, it is determined that the model to be detected has not been attacked.

[0116] The process of the attack detection device determining whether there is a target trigger obtained by the first scanner from the model to be detected can be determined by the formula 6 described above. From a mathematical logic point of view, during the scanning process of the scanner on the model to be detected, the scanner will convert each target tag in the target tag set into And each training sample is brought into Formula 6, and the parameter of t is adjusted in the direction of decreasing the loss value. The attack detection device verifies whether the attack success rate corresponding to t on the test sample set is greater than the preset threshold. If it is greater than the preset threshold, t is considered to be the target trigger, and the model to be detected has been attacked by the backdoor. If it does not exceed the preset threshold, the next scanner is used to scan the model to be detected until all scanners of all attack types have completed scanning the model to be detected, and it is confirmed that the target trigger has not been scanned, then it is determined that the model to be detected has not been attacked by the backdoor. Among them, the specific method for the attack detection device to determine the attack success rate of trigger t can correspond to the content described above, and will not be repeated here.

[0117] Based on the same inventive concept, an embodiment of the present application provides an attack detection device, which is used to implement any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown in the figure can also realize the function of the attack detection device mentioned above.

[0118] Please refer to Figure 4 , is a schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. Figure 4 As shown, the attack detection device 400 includes a classification module 401, a generation module 402 and a scanning module 403. Optionally, the attack detection device 400 also includes a decomposition module 404.

[0119] Exemplarily, the classification module 401 is used to summarize and classify the sample trigger set according to the sample trigger set and a preset clustering algorithm to obtain a sample trigger subset of multiple attack types; the generation module is used to generate a scanner corresponding to each attack type according to the sample trigger subset of each attack type in the multiple attack types; the scanning module is used to scan the model to be detected in turn according to the scanner corresponding to each attack type to obtain a scanning result, and the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger that attacks the model to be detected.

[0120] In a possible implementation, the attack detection device 400 also includes a decomposition module 404, which is used to: perform a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample, where each attack sample is obtained by injecting a sample trigger into a clean sample; iteratively optimize the initial sample trigger and the initial clean sample based on a pre-trained first sample reconstruction model and a preset infection model until a target sample trigger for each attack sample is obtained; wherein the first sample reconstruction model is used to iteratively optimize the initial clean sample based on the first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain an optimized sample trigger; the infection model is used to determine the error between the optimized sample trigger and the clean sample compared to the reference sample trigger and the reference clean sample based on the verified attack sample, and the verified attack sample is obtained by reconstructing the optimized sample trigger based on the second sample reconstruction operation, and the error is used to adjust the model parameters of the first sample reconstruction model until the target sample trigger is obtained; the target sample trigger corresponding to each attack sample in the attack sample set is formed into a sample trigger set.

[0121] In a possible implementation, the decomposition module 404 is specifically used to: perform the following operations on an attack sample in the attack sample set: based on the first sample reconstruction model, perform a first sample reconstruction operation on the first clean sample to obtain a second clean sample, the first clean sample is obtained by decomposing an attack sample based on a preset first sample trigger, and the error between the second clean sample and the reference clean sample is less than the error between the first clean sample and the reference clean sample; based on the second clean sample, decompose an attack sample to obtain a second sample trigger, and the error between the second sample trigger and the reference sample trigger is less than the error between the first sample trigger and the reference sample trigger; perform a second sample reconstruction operation on the second sample trigger to obtain a verified attack sample; input the verified attack sample and the second clean sample into the infection model to obtain detection results for the verified attack sample and the second clean sample; based on the detection results, the second clean sample and the second sample trigger, in combination with the preset loss function, adjust the model parameters of the first sample reconstruction model until the preset conditions are met to obtain the target sample trigger.

[0122] In a possible implementation, the trigger types include a first type and a second type, the first type corresponds to a first decomposition algorithm, and the second type corresponds to a second decomposition algorithm; the initial sample trigger includes a first initial sample trigger and a second initial sample trigger, and the initial clean sample includes a first initial clean sample and a second initial clean sample; the decomposition module 404 is specifically used to: based on the first sample reconstruction model and the infection model, iteratively optimize the first initial sample trigger and the first initial clean sample to obtain a third trigger, the first initial clean sample is obtained by decomposing each attack sample based on the first decomposition algorithm and the first initial sample trigger; based on the first sample reconstruction model and the infection model, iteratively optimize the second initial sample trigger and the second initial clean sample to obtain a fourth trigger, the second initial clean sample is obtained by decomposing each attack sample based on the second decomposition algorithm and the second initial sample trigger; determine a first attack success rate corresponding to the third trigger and a second attack success rate corresponding to the fourth trigger; determine the trigger with a larger attack success rate between the third trigger and the fourth trigger as the target sample trigger for each attack sample.

[0123] In a possible implementation, the generation module 402 is specifically used to: determine the Gaussian distribution coefficient of each attack type according to a preset Gaussian distribution algorithm and a sample trigger subset of each attack type; and generate a scanner for each attack type according to the Gaussian distribution coefficient.

[0124] In one possible implementation, the scanning module 403 is specifically used to: scan the model to be detected in turn according to the scanner corresponding to each attack type; if a first scanner obtains a target trigger from the model to be detected by scanning, it is determined that the model to be detected has been attacked, wherein the third attack success rate corresponding to the target trigger is greater than a preset threshold; the attack type corresponding to the first scanner is determined as the attack type of the target trigger, and a scanning result is generated.

[0125] Based on the same inventive concept, an embodiment of the present application provides an attack detection device, which is used to implement any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown in the figure can also realize the function of the attack detection device mentioned above.

[0126] Please refer to Figure 5 , is a schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. Figure 5 As shown, the attack detection device 500 includes at least one processor 501 and a memory 502 communicatively connected to the at least one processor 501 .

[0127] The processor 501 may be a general-purpose processor or a dedicated processor. The processor 501 may include, for example, a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data. The central processing unit may be used to control the attack detection device 500, execute software programs and / or process data. Different processors may be independent devices or may be arranged in one or more processing circuits, for example, integrated in one or more dedicated integrated circuits.

[0128] In one embodiment, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 implements the functions of the attack detection device as described above by executing the instructions stored in the memory 502, and accordingly, can also implement the steps performed by the attack detection device as described above.

[0129] In this embodiment, the attack detection device 500 can also implement the functions of the previous attack detection device 400, and at least one processor 501 in the attack detection device 500 can also implement the functions of the previous classification module 401, generation module 402, scanning module 403 and decomposition module 404.

[0130] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any of the attack detection methods described above, for example, Figure 2 Attack detection method shown.

[0131] Based on the same inventive concept, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown is implemented.

[0132] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: include: According to the sample trigger set and a preset clustering algorithm, the sample trigger set is classified and summarized to obtain sample trigger subsets of multiple attack types; Generate a scanner corresponding to each attack type according to a subset of sample triggers of each attack type in the multiple attack types; According to the scanner corresponding to each attack type, the model to be detected is scanned in turn to obtain a scanning result, wherein the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger that attacks the model to be detected; Before classifying the sample trigger set according to the sample trigger set and a preset clustering algorithm to obtain sample trigger subsets of multiple attack types, the method further includes: Performing a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample, wherein each attack sample is obtained by injecting the sample trigger into the clean sample; Based on the pre-trained first sample reconstruction model and the preset infection model, the initial sample trigger and the initial clean sample are iteratively optimized until the target sample trigger of each attack sample is obtained; wherein the first sample reconstruction model is used to iteratively optimize the initial clean sample based on the first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain the optimized sample trigger; the infection model is used to determine the error between the optimized sample trigger and the clean sample compared with the reference sample trigger and the reference clean sample according to the verification attack sample, and the verification attack sample is obtained by reconstructing the optimized sample trigger based on the second sample reconstruction operation, and the error is used to adjust the model parameters of the first sample reconstruction model until the target sample trigger is obtained; Grouping the target sample triggers corresponding to each attack sample in the attack sample set into the sample trigger set; The step of generating a scanner corresponding to each attack type according to a subset of sample triggers of each attack type in the multiple attack types comprises: determining a Gaussian distribution coefficient of each attack type according to a preset Gaussian distribution algorithm and the subset of sample triggers of each attack type; and generating a scanner for each attack type according to the Gaussian distribution coefficient and a preset loss function; The scanner corresponding to each attack type scans the model to be detected in turn to obtain a scanning result, including: if there is a first scanner that scans the target trigger from the model to be detected, it is determined that the model to be detected has been attacked.

2. The method according to claim 1, characterized in that Based on the pre-trained first sample reconstruction model and the preset infection model, iteratively optimizing the initial sample trigger and the initial clean sample until a target sample trigger for each attack sample is obtained, including: The following operations are performed on an attack sample in the attack sample set: Based on the first sample reconstruction model, performing the first sample reconstruction operation on a first clean sample to obtain a second clean sample, wherein the first clean sample is obtained by decomposing the one attack sample based on a preset first sample trigger, and an error between the second clean sample and the reference clean sample is less than an error between the first clean sample and the reference clean sample; Based on the second clean sample, decomposing the one attack sample to obtain a second sample trigger, wherein an error between the second sample trigger and the reference sample trigger is smaller than an error between the first sample trigger and the reference sample trigger; Performing the second sample reconstruction operation on the second sample trigger to obtain the verification attack sample; Inputting the verification attack sample and the second clean sample into the infection model to obtain detection results for the verification attack sample and the second clean sample; Based on the detection result, the second clean sample and the second sample trigger, in combination with a preset loss function, the model parameters of the first sample reconstruction model are adjusted until a preset condition is met to obtain the target sample trigger.

3. The method according to claim 1, characterized in that The trigger type includes a first type and a second type, the first type corresponds to a first decomposition algorithm, and the second type corresponds to a second decomposition algorithm; the initial sample trigger includes a first initial sample trigger and a second initial sample trigger, and the initial clean sample includes a first initial clean sample and a second initial clean sample; The reconstructing model based on the pre-trained first sample and the preset infection model, iteratively optimizing the initial sample trigger and the initial clean sample until a target sample trigger for each attack sample is obtained, includes: Iteratively optimizing the first initial sample trigger and the first initial clean sample based on the first sample reconstruction model and the infection model to obtain a third trigger, wherein the first initial clean sample is obtained by decomposing each attack sample based on the first decomposition algorithm and the first initial sample trigger; Iteratively optimizing the second initial sample trigger and the second initial clean sample based on the first sample reconstruction model and the infection model to obtain a fourth trigger, where the second initial clean sample is obtained by decomposing each attack sample based on the second decomposition algorithm and the second initial sample trigger; Determine a first attack success rate corresponding to the third trigger and a second attack success rate corresponding to the fourth trigger; The trigger with a higher attack success rate between the third trigger and the fourth trigger is determined as the target sample trigger of each attack sample.

4. The method according to any one of claims 1 to 3, characterized in that: According to the scanner corresponding to each attack type, the models to be detected are scanned in turn to obtain scanning results, which also includes: The third attack success rate corresponding to the target trigger is greater than a preset threshold; The attack type corresponding to the first scanner is determined to correspond to the attack type of the target trigger, and the scanning result is generated.

5. An attack detection device, characterized in that: include: A classification module, used to classify the sample trigger set according to the sample trigger set and a preset clustering algorithm to obtain a subset of sample triggers of multiple attack types; A generating module, configured to generate a scanner corresponding to each attack type according to a subset of sample triggers of each attack type in the plurality of attack types; A scanning module, used to scan the model to be detected in turn according to the scanner corresponding to each attack type, and obtain a scanning result, wherein the scanning result is used to indicate whether the model to be detected is attacked and the attack type of the target trigger that attacks the model to be detected; The device further includes a decomposition module, which is used to: perform a sample decomposition operation on each attack sample in the attack sample set to obtain an initial sample trigger and an initial clean sample, wherein each attack sample is obtained by injecting a sample trigger into a clean sample; iteratively optimize the initial sample trigger and the initial clean sample based on a pre-trained first sample reconstruction model and a preset infection model until a target sample trigger for each attack sample is obtained; wherein the first sample reconstruction model is used to iteratively optimize the initial clean sample based on a first sample reconstruction operation, and the optimized clean sample is used to decompose to obtain an optimized sample trigger; the infection model is used to determine the error between the optimized sample trigger and the clean sample compared to the reference sample trigger and the reference clean sample according to the verification attack sample, wherein the verification attack sample is obtained by reconstructing the optimized sample trigger based on the second sample reconstruction operation, and the error is used to adjust the model parameters of the first sample reconstruction model until the target sample trigger is obtained; the target sample trigger corresponding to each attack sample in the attack sample set is grouped into the sample trigger set; The generation module is specifically used to: determine the Gaussian distribution coefficient of each attack type according to a preset Gaussian distribution algorithm and a sample trigger subset of each attack type; and generate a scanner of each attack type according to the Gaussian distribution coefficient and a preset loss function; The scanning module is specifically used to: if there is a first scanner that scans the target trigger from the model to be detected, then determine that the model to be detected has been attacked.

6. An attack detection device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions to be executed by the at least one processor, and the at least one processor implements the method according to any one of claims 1 to 4 by executing the instructions stored in the memory.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 4.

8. A computer program product, characterized in that The method comprises computer instructions, which, when executed on a computer, enable the method according to any one of claims 1 to 4 to be implemented.

Images