Backdoor defense method of image classification model, image classification method and related equipment

Abstract

The embodiment of the invention provides a back door defense method of an image classification model, an image classification method and related equipment. The backdoor defense method comprises the following steps: acquiring a first test data set, an image classification model, a generator, a first label and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator; inputting the first label and a plurality of corresponding first random noises into a generator, and outputting a plurality of first disturbance quantities; determining whether the first tag is an attack target tag according to the similarity of the plurality of first disturbance quantities; generating a second test data set; inputting the first test data set into an image classification model to determine a first activation state of a plurality of neurons of the image classification model; inputting the second test data set into the image classification model, and determining a second activation state of a plurality of neurons of the image classification model; and according to the first activation state and the second activation state, determining a back door neuron of the image classification model, and clearing the back door neuron.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a backdoor defense method for an image classification model, an image classification method, and related equipment. Background Art

[0002] Deep Neural Network (DNN) systems are increasingly responsible for critical decision-making tasks in areas such as self-driving cars, disease diagnosis, facial recognition, and malware detection. However, as DNN systems become more prevalent, malicious attackers have a stronger incentive to tamper with these systems. Backdoor attacks can lurk in the model undetected until the attacker chooses the right time and place to launch an attack.

[0003] In the related art, the defense method against backdoor attacks has the problem of insufficient versatility. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a backdoor defense method for an image classification model, an image classification method and related equipment.

[0005] Based on the above purpose, the present application provides a backdoor defense method for an image classification model, and the backdoor defense method includes:

[0006] Obtain a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator;

[0007] Inputting a first label and a corresponding plurality of first random noises into the generator, and outputting a plurality of first disturbance quantities;

[0008] Determining whether the first label is an attack target label according to the similarities of the multiple first disturbance quantities;

[0009] In response to determining that the first label is an attack target label, generating a second test data set according to the first test data set and the plurality of first disturbance quantities;

[0010] Inputting the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model;

[0011] Inputting the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model;

[0012] According to the first activation state and the second activation state, a backdoor neuron of the image classification model is determined, and the backdoor neuron is cleared.

[0013] In some embodiments, determining whether the first label is an attack target label according to the similarities of the plurality of first disturbance quantities includes:

[0014] Calculating similarity values ​​between each of the plurality of first disturbance quantities respectively;

[0015] Based on the similarity value, obtaining an average of the similarity values ​​between any two of the plurality of first disturbance quantities;

[0016] Based on the magnitude relationship between the mean and the threshold, it is determined whether the label is an attack target label.

[0017] In some embodiments, the first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity value includes the pixel similarity value or the Euclidean distance; and the determining whether the label is an attack target label based on the size relationship between the mean and the threshold value includes:

[0018] In response to determining that the mean value is greater than a pixel similarity value threshold, determining that the tag is an attack target tag; or

[0019] In response to determining that the mean of the Euclidean distances is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label.

[0020] In some embodiments, the first test data set includes: a plurality of first test images; the second test data set includes: a plurality of second test images corresponding one-to-one to the plurality of first test images;

[0021] The step of determining a backdoor neuron of the image classification model according to the first activation state and the second activation state includes:

[0022] Inputting a plurality of the first test images and a corresponding plurality of the second test images into the image classification model;

[0023] For any of the neurons, determine that the first activation state of the neuron is inactive and the second activation state is activated a first number of times; determine that the first activation state of the neuron is activated a second number of times; determine a ratio of the first number to the second number; and in response to determining that the ratio satisfies a preset threshold, determine that the neuron is the backdoor neuron.

[0024] In some embodiments, the first label is set to be multiple; the first label and the corresponding multiple first random noises are input into the generator, and the multiple first disturbances are output, including: the first label and the corresponding multiple first random noises are input into the generator multiple times, and the multiple first disturbances are output multiple times; wherein the first label input each time is different; the first label input each time corresponds to the multiple first random noises respectively; and / or

[0025] The clearing of the backdoor neurons comprises: pruning the backdoor neurons; and / or

[0026] Generating the second test data set according to the first test data set and the plurality of first disturbance quantities comprises: adding the plurality of first disturbance quantities one-to-one to the plurality of first test images of the first test data set, respectively, to obtain a plurality of second test images, namely, the second test data set.

[0027] The present application also provides an image classification method, including:

[0028] Get the image to be classified;

[0029] The image to be classified is input into an image classification model obtained according to the backdoor defense method as described in any of the preceding items to obtain the category of the image to be classified.

[0030] The embodiment of the present application also provides a backdoor defense device for an image classification model, including:

[0031] A first acquisition module is configured to: acquire a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator;

[0032] An output module is configured to: input the first label and the corresponding plurality of first random noises into the generator, and output a plurality of first disturbance quantities;

[0033] A first determination module is configured to: determine whether the first label is an attack target label according to the similarity of the plurality of first disturbance quantities;

[0034] A generating module, configured to: in response to determining that the first label is an attack target label, generate a second test data set according to the first test data set and the plurality of first disturbance quantities;

[0035] A second determination module is configured to: input the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model;

[0036] A third determination module is configured to: input the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model;

[0037] A clearing module is configured to: determine the backdoor neuron of the image classification model according to the first activation state and the second activation state, and clear the backdoor neuron.

[0038] In some embodiments, the first determining module is configured to:

[0039] Calculating similarity values ​​between each of the plurality of first disturbance quantities respectively;

[0040] Based on the similarity value, obtaining an average of the similarity values ​​between any two of the plurality of first disturbance quantities;

[0041] Based on the magnitude relationship between the mean and the threshold, it is determined whether the label is an attack target label.

[0042] In some embodiments, the first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity value includes the pixel similarity value or the Euclidean distance; and the first determination module is configured as follows:

[0043] In response to determining that the mean value is greater than a pixel similarity value threshold, determining that the tag is an attack target tag; or

[0044] In response to determining that the mean of the Euclidean distances is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label.

[0045] In some embodiments, the first test data set includes: a plurality of first test images; the second test data set includes: a plurality of second test images corresponding one-to-one to the plurality of first test images;

[0046] The clearing module is configured to: input a plurality of the first test images and a corresponding plurality of the second test images into the image classification model;

[0047] For any of the neurons, determine that the first activation state of the neuron is inactive and the second activation state is activated a first number of times; determine that the first activation state of the neuron is activated a second number of times; determine a ratio of the first number to the second number; and in response to determining that the ratio satisfies a preset threshold, determine that the neuron is the backdoor neuron.

[0048] In some embodiments, the first label is set to be multiple; the output module is configured to: input the first label and the corresponding multiple first random noises into the generator multiple times, and output multiple first disturbance quantities multiple times; wherein the first label input each time is different; the first label input each time corresponds to multiple first random noises; and / or

[0049] The cleaning module is configured to: prune the backdoor neurons; and / or

[0050] The generating module is configured to: add the multiple first disturbance quantities to the multiple first test images of the first test data set in a one-to-one correspondence, respectively, to obtain multiple second test images, that is, to obtain the second test data set.

[0051] The present application also provides an image classification device, including:

[0052] The second acquisition module is configured to: acquire an image to be classified;

[0053] The second generating module is configured to: input the image to be classified into the image classification model obtained by the backdoor defense method as described in any of the previous items to obtain the category of the image to be classified.

[0054] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, instructions for implementing the backdoor defense method as described in any one of the preceding items or the image classification method as described in the preceding items are implemented.

[0055] An embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the backdoor defense method as described in the previous item or the image classification method as described in the previous item.

[0056] An embodiment of the present application also provides a computer program product, a computer program product comprising computer program instructions, which, when executed on a computer, enable the computer to execute the backdoor defense method as described in any one of the preceding items or the image classification method as described in the preceding items.

[0057] As can be seen from the above, the backdoor defense method of the image classification model provided in the embodiment of the present application is obtained by obtaining a first test data set, an image classification model, a generator, a first label and a plurality of first random noises corresponding to the first label; wherein the image classification model is the discriminator of the generator; the first label and the corresponding plurality of first random noises are input into the generator, and a plurality of first disturbances are output; according to the similarity of the plurality of first disturbances, whether the first label is an attack target label is determined; in response to determining that the first label is an attack target label, a second test data set is generated according to the first test data set and the plurality of first disturbances; the first test data set is input into the image classification model to determine the first activation state of the plurality of neurons of the image classification model; the second test data set is input into the image classification model to determine the second activation state of the plurality of neurons of the image classification model; according to the first activation state and the second activation state, the backdoor neurons of the image classification model are determined, and the backdoor neurons are cleared. It is independent of a specific model and data set and has strong versatility. At the same time, only one generator needs to be trained in the defense process, and only the test set data is used, so that no additional labeling cost is required, which can greatly reduce the training cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 A schematic diagram of a framework of a backdoor defense method for an image classification model according to an embodiment of the present application;

[0060] Figure 2 A flowchart of a backdoor defense method for an image classification model according to an embodiment of the present application;

[0061] Figure 3 A schematic diagram of a framework of a conditional generative adversarial network training process according to an embodiment of the present application;

[0062] Figure 4 A schematic diagram of a conditional generative adversarial network training process according to an embodiment of the present application;

[0063] Figure 5 A schematic diagram of the neuron pruning process in an embodiment of the present application;

[0064] Figure 6 A schematic diagram of the neuron pruning process of an embodiment of the present application;

[0065] Figure 7 A schematic diagram of another flowchart of the conditional generation method for defending against network backdoors according to an embodiment of the present application;

[0066] Figure 8 A schematic diagram of the process of an image classification method according to an embodiment of the present application;

[0067] Fig. 9 A schematic diagram of a backdoor defense device for an image classification model according to an embodiment of the present application;

[0068] Fig.10 A schematic diagram of an image classification device according to an embodiment of the present application;

[0069] Fig.11 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0071] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0072] A trigger is an object placed in a digital visual scene, usually a sticker or an object known only to the attacker. Backdoor attacks are constructed by printing a trigger on a clean image to activate the backdoor, so the trigger is usually small and difficult to detect. Since building a DNN system usually requires the following three conditions: a large amount of accurately labeled training data, expensive and abundant computing resources, and expertise in model building. Therefore, many practitioners use transfer learning to reduce the time and cost of building DNN systems. In transfer learning, developers use pre-trained models in open source model libraries, which may have potential vulnerabilities, whether intentional or unintentional. For example, a backdoor or Trojan is created by implanting specific training samples into the model. The backdoor model behaves normally under normal input. However, when a trigger appears in the input, the trigger causes the backdoor model to make incorrect predictions. Since a DNN model has millions of parameters, it is very difficult to analyze or explain how it makes decisions and whether there are hidden classification rules.

[0073] The backdoor defense methods for deep neural networks in related technologies mainly include defense methods through spatial transformation, methods of enhancing attacks, data enhancement methods of "boundary enhancement", methods of black box backdoor detection, methods of removing potential triggers in inputs and restoring inputs, the concept of pattern connectivity in loss landscapes, systems for detecting and mitigating backdoor attacks in neural networks, and benchmark technologies for universal touchstone patterns.

[0074] Among them, a simple and effective defense method of testing samples through spatial transformation (such as flipping or scaling), and a method of enhancing attacks, mainly by randomly transforming all poisoned images during training to improve the robustness of the attack to trigger changes. The data enhancement method of "boundary enhancement" is used to defend against poisoning attacks in deep neural networks. This method is implemented by estimating the distribution of poisoned data and retraining the backdoor model with a small amount of training data, searching for the manifold boundary of poisoned data and clean data, and retraining the model through adversarial training and data enhancement, thereby improving the model's generalization ability to various poisoning attack methods. A black-box backdoor detection method is used to identify backdoor attacks in deep neural networks in a black-box environment with only model query permissions. This method reverse engineers the potential triggers of each category through a gradient-free optimization algorithm to reveal the existence of backdoor attacks.

[0075] Among them, the method of removing potential triggers in the input and restoring the input can maintain the classification performance of the model for the purified input without retraining or using expensive labeled data. The concept of pattern connectivity in the loss landscape is mainly used to improve the robustness of network models in the face of backdoor attacks or error injection attacks. The system for detecting and mitigating backdoor attacks in neural networks can identify backdoors and reconstruct possible triggers, and mitigate the impact of backdoors through techniques such as input filtering, neuron pruning, and anti-learning. The benchmark technology of universal touchstone patterns can detect backdoor attacks in deep convolutional neural networks and reveal backdoor attacks by inputting these universal patterns into the network and analyzing the output. The detection process is fast and does not require access to training data or running tests on clean data.

[0076] The above methods all have certain limitations. For example, when faced with complex or multiple triggers, unknown backdoor attacks, specific neural network structures and data sets, the backdoor defense effect may be weakened, or additional labeling and additional training costs may be required. Therefore, the methods of related technologies have the problem of insufficient versatility.

[0077] Based on this, the embodiments of the present application provide a backdoor defense method for an image classification model, an image classification method and related devices, such as Figure 1 As shown in the figure, by making full use of the ability of conditional generative adversarial networks, the trigger is reconstructed, the target to be attacked is discovered, and the model is pruned according to the target. It is independent of specific models and data sets and has strong versatility. At the same time, in the defense process, only one generator needs to be trained and only the test set data is used, so there is no need for additional labeling costs, which can greatly reduce the training cost.

[0078] Figure 2 A flow chart of a backdoor defense method for an image classification model according to an embodiment of the present application is shown.

[0079] like Figure 2 As shown, the backdoor defense method of the image classification model in the embodiment of the present application may include:

[0080] S100, obtaining a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator;

[0081] S200, inputting a first label and a corresponding plurality of first random noises into the generator, and outputting a plurality of first disturbance quantities;

[0082] S300, determining whether the first label is an attack target label according to the similarities of the multiple first disturbance quantities;

[0083] S400, in response to determining that the first label is an attack target label, generating a second test data set according to the first test data set and the plurality of first disturbance quantities;

[0084] S500, inputting the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model;

[0085] S600, inputting the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model;

[0086] S700: Determine a backdoor neuron of the image classification model according to the first activation state and the second activation state, and clear the backdoor neuron.

[0087] The backdoor defense method for the image classification model provided in the embodiment of the present application can reverse engineer possible triggers, determine the intention and strategy of the backdoor attack, and has good versatility for variants of the backdoor attack; only test set data is required to construct a conditional generative adversarial network without the need for additional labeling costs; only one generator is required to determine the attack target, and there is no need to train different generators for different labels, thereby reducing training costs.

[0088] Wherein, in step S100, the image classification model may be a pre-trained image classification model; the generator may be a pre-trained generator; the image classification model may be a deep neural network model. For example, it may be a classic deep convolutional neural network, a deep convolutional neural network model based on an attention mechanism, a lightweight deep convolutional neural network model, and a network model based on a neural architecture search. The embodiment of the present application does not limit the specific model architecture and specific classification tasks of the image classification model. Generally, the pre-trained image classification model may be an image classification model that has been trained with a training data set and optimized with a verification data set.

[0089] Among them, the discriminator of the generator / the pre-trained generator is the pre-trained image classification model, so that the pre-trained generator and the image classification model / pre-trained image classification model constitute a pre-trained conditional generative adversarial network. In this way, the distribution of real data can be learned through adversarial training, and new data similar to it can be generated. According to the feedback of the image classification model (that is, the target classification model), a more realistic and concise trigger (that is, the perturbation amount) can be generated. The pre-trained generator can be trained based on multiple different first labels.

[0090] The first test data set may be an image data set of an image classification model, including a plurality of first test images. Each first test image itself corresponds to a real label, such as a second label. By using the test set of the image classification model, it is possible to avoid introducing additional labeling costs.

[0091] In some embodiments, such as Figure 3 As shown, the training method of the generator / the pre-trained generator (that is, the pre-trained conditional generative adversarial network) may include:

[0092] Initialize the generator (for example, generator G);

[0093] The generator (e.g., generator G) is subjected to multiple rounds of training (e.g., n rounds of training): wherein the first label (e.g., first label y) input in each round of training is different, and the first label (e.g., first label y) in each round of training corresponds to a plurality of different random noises (e.g., random noise z). Typically, the first test data set in each round of training is a test data set that does not contain the first label, that is, a clean test data set. The first test data set may be preprocessed before the start of training so that the first test data set does not include the first label. The image data including the first label in the first test data set may be directly removed so that the first test data set does not include the first label, thereby obtaining a pure first test data set.

[0094] Each round of training may include:

[0095] A first label (e.g., first label y) and a plurality of random noises (e.g., random noise z) corresponding to the first label are input into the generator to be trained, and a plurality of first disturbances (e.g., first disturbances r) corresponding to the first label are output. i ). The first disturbance amount can be understood as some specific pixel changes that can cause the backdoor model to misjudge the category of these images. The first disturbance amount may include position and shape data, for example, it may include the coordinates of the pixel points and the pixel values ​​of the pixel points, so that the image of the trigger can be determined, and which pixels in the test image in the first test data set to which the trigger is added can be determined, and the magnitude of the modification of these pixels can be determined. Generally, the first label can be understood as additional information to guide the generation process, which can be represented by a one-hot vector. Random noise can come from a priori noise distribution, such as uniform distribution or normal distribution.

[0096] Add multiple first disturbance amounts to multiple images to be tested (for example, image x) of the first test data set to synthesize multiple perturbed images (for example, image x i ), and obtain the second test data set.

[0097] The second test data set is respectively input into the discriminator (ie, the pre-trained image classification model) (eg, discriminator f), and a third label of the second test data set is output.

[0098] A loss function is calculated based on the third label and the first label, and the generator parameters are trained by back propagation.

[0099] Determine whether the third label is the same as the first label or whether the number of training rounds reaches a threshold value based on the value of the multi-round loss function, and determine whether the training is completed. Specifically, it can include determining that the training is completed when it is determined that the third label is the same as the first label or the number of training rounds reaches a threshold value, that is, the pre-trained generator is obtained. Or when it is determined that the third label is not the same as the first label or the training threshold number is not reached, return to the step of inputting the second test data set into the discriminator (that is, the pre-trained image classification model),

[0100] Until it is determined that the third label is the same as the first label or the number of training rounds reaches a threshold.

[0101] In this way, we can leverage the power of conditional generative adversarial networks to reverse engineer possible trigger patterns by minimizing the difference between input and output.

[0102] In some embodiments, in step S200, the first label can be set to multiple, for example, n. Different first labels and multiple first random noises corresponding to the first labels can be input into the pre-trained generator multiple times, and multiple first disturbances are output each time. The first labels input each time are different, and the first labels input each time correspond to multiple first random noises. Generally, the first labels input each time are different can mean that the values ​​of the first labels input each time are different. It can be understood that the first labels input multiple times here can be the same as the first labels input multiple times in the generator training process mentioned above. That is, the first label and the corresponding multiple first random noises are input into the pre-trained generator, and the output of multiple first disturbances includes: inputting the first label and the corresponding multiple first random noises into the generator multiple times, and outputting multiple first disturbances multiple times; wherein the first labels input each time are different; the first labels input each time correspond to multiple first random noises.

[0103] In some embodiments, in step S300, Figure 4 and Figure 7 As shown, determining whether the first label is an attack target label according to the similarities of the multiple first disturbance quantities may include:

[0104] Based on a plurality of first disturbance quantities corresponding to the same label, similarity values ​​between any two of the plurality of first disturbance quantities are calculated respectively.

[0105] Based on the similarity values ​​between any two of the plurality of first disturbance quantities, an average value of the similarity values ​​between any two of the plurality of first disturbance quantities is obtained.

[0106] Based on the relationship between the mean of the similarity values ​​between the multiple first disturbances and the threshold, it is determined whether the label is an attack target label (for example, target label t). Here, the attack target label can be understood as the target label that the attacker wants the image classification model to output.

[0107] In this way, two non-repeating disturbance quantities can be selected from all first disturbance quantities obtained with the same first label, and the similarity of the two disturbance quantities can be calculated, thereby obtaining the average of the similarities of all disturbance quantities corresponding to the same first label.

[0108] In some embodiments, the first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity may include a pixel similarity value or a Euclidean distance; the threshold includes a pixel similarity value threshold or a Euclidean distance threshold. Generally, the pixel similarity value can be obtained by the grayscale value between pixels. The pixel similarity value threshold can be set according to experience and requirements, for example, it can be 50%. The determination of whether the label is an attack target label based on the size relationship between the mean and the threshold may include:

[0109] In response to determining that the average of the pixel similarity values ​​between any two of the plurality of first disturbances is greater than the pixel similarity value threshold, determining that the label is an attack target label; or in response to determining that the average of the pixel similarity values ​​between any two of the plurality of first disturbances is less than or equal to the pixel similarity value threshold, determining that the label is not an attack target label; or

[0110] In response to determining that the Euclidean distance between any two of the multiple first disturbance quantities is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label; or in response to determining that the Euclidean distance between any two of the multiple first disturbance quantities is greater than a Euclidean distance threshold, determining that the label is not an attack target label.

[0111] In this way, by comparing the activations in the model of the test set images with backdoor labels and the test set images with triggers, it is possible to determine which neurons are sensitive to the trigger, that is, manipulated by the attacker.

[0112] In practical applications, multiple disturbances r corresponding to the same first label can be i Do not repeat the selection of two disturbance quantities in and Calculate their pixel similarity value or Euclidean distance, repeat the above process, and average the final results to get the perturbation value r i The corresponding average pixel similarity value or average Euclidean distance. When the similarity exceeds 50% or the Euclidean distance is less than or equal to the set threshold, the label is determined to be the attack target label, that is, the image with the corresponding trigger pattern will be judged as label t by the backdoor model f. If there is no trigger pattern with a similarity exceeding 50% or the Euclidean distance is greater than a certain set threshold, the model f is determined to be a clean model.

[0113] In some embodiments, in step S400, generating the corresponding second test data set according to the first test data set and the corresponding multiple first disturbance quantities may include: respectively adding the multiple first disturbance quantities to the multiple first test images of the first test data set to obtain multiple second test images, that is, the second test data set. Usually, the multiple first disturbance quantities correspond one-to-one to the multiple test images of the first test data set. The multiple first test images correspond one-to-one to the multiple second test images. The first test data set includes multiple first image data first test images without first labels; the second test data set includes multiple second image data second test images corresponding one-to-one to the multiple first image data first test images.

[0114] In some embodiments, the first test data set may be a test data set without a first label, that is, a clean test data set. Before generating the second test data set, the first test data set may be preprocessed so that the first test data set does not include the first label. The image data including the first label in the first test data set may be directly removed so that the first test data set does not include the first label, thereby obtaining a clean first test data set.

[0115] It is understandable that when there are multiple attack target labels, that is, when there are multiple first labels as attack target labels, multiple disturbance amounts corresponding to each first label can be added to the first test data set without the corresponding first label to obtain the corresponding second test data set. Finally, multiple second test data sets are obtained.

[0116] In some embodiments, such as Figure 5 and Figure 6 As shown, in step S500, inputting the first test data set into the image classification model to determine the first activation state of multiple neurons of the image classification model may include:

[0117] The multiple first test images are input into the image classification model to obtain multiple first activation states of multiple neurons. The multiple first activation states of each neuron correspond to the multiple first test images one by one. In this way, multiple first activation states of multiple neurons of the image classification model after the first test data set is input can be obtained. Generally, the activation state of a neuron can be determined based on the relationship between the output value of the neuron and the threshold. For example, when the output value of the neuron is greater than the threshold, it can be determined that the neuron is in an activated state, and when the output value of the neuron is less than the threshold, usually a very small value, it can be determined that the neuron is not activated.

[0118] In some embodiments, such as Figure 5 and Figure 6 As shown, in step S600, determining the backdoor neuron of the image classification model according to the first activation state of the neuron of the image classification model after the first test data set is input and the second activation state of the neuron of the image classification model after the second test data set is input may include:

[0119] The multiple second test images are input into the image classification model to obtain multiple second activation states of multiple neurons. The multiple second activation states of each neuron correspond to the multiple second test images one by one. In this way, multiple second activation states of multiple neurons of the image classification model after the second test data set is input can be obtained. It can be understood that when there are multiple second test data sets, the second test data set here is the second test data set corresponding to the current first test data set.

[0120] In some embodiments, such as Figure 5 and Figure 6 As shown, in step S700, the backdoor neurons of the image classification model are determined based on the multiple first activation states and the corresponding multiple second activation states of the multiple neurons.

[0121] In some embodiments, determining the backdoor neuron of the image classification model based on the multiple first activation states and the corresponding multiple second activation states of the multiple neurons may include:

[0122] Taking a single neuron as a unit, based on the multiple first activation states and the corresponding multiple second activation states of each neuron, the number of times the second activation state of the neuron is an activated state and the first activation state is an inactivated state is determined. In this way, the number of times the neuron is not activated after the first test image is input but is activated after the second test image with a trigger is input (for example, the first number) is obtained, and neurons that are sensitive to triggers are preliminarily obtained.

[0123] The ratio of the number in the multiple activation states is calculated, and in response to determining that the ratio of the number of times to the number corresponding to the multiple second activation states (that is, the total number of the first test images) is greater than a threshold ratio, the target neuron is determined to be a backdoor neuron of the image classification model. It can be understood that for any of the neurons, the number of times the first activation state of the neuron is inactive and the second activation state is active is determined; the ratio of the number of times to the total number of the first test images is determined; in response to determining that the ratio meets a preset threshold, the neuron is determined to be the backdoor neuron.

[0124] In this way, by comparing the activation of the first test data set and the second test data set with triggers in the image classification model, it is possible to determine which neurons are sensitive to triggers, that is, these neurons are not activated when the original first test image is input, but are activated when the second test image with the trigger added is input, so these neurons are manipulated by the backdoor attacker.

[0125] In some embodiments, determining the backdoor neuron of the image classification model based on the multiple first activation states and the corresponding multiple second activation states of the multiple neurons may include:

[0126] Inputting a plurality of the first test images and a corresponding plurality of the second test images into the image classification model;

[0127] For any of the neurons, determine the first number of times that the first activation state of the neuron is inactive and the second activation state is active; determine the second number of times that the first activation state of the neuron is active; determine the ratio of the first number to the second number; in response to determining that the ratio meets a preset threshold, determine that the neuron is the backdoor neuron. Wherein, the first activation state is active, which means that as long as the first activation state is active, the first activation state is counted as active regardless of whether the second activation state is active or inactive. It should be understood that since the number of test sets is usually tens of thousands, hundreds of thousands, or even millions, the second number of times that a neuron is active in the first activation state is usually almost non-zero.

[0128] It can be understood that, taking a single neuron as a unit, the number of times the neuron is activated in multiple first activation states and corresponding multiple second activation states is counted, and when the ratio of the number of times the neuron is activated in the second activation state to the number of times the neuron is activated in the first activation state exceeds a threshold, the target neuron is determined to be the backdoor neuron. In this way, the backdoor can be eliminated to the greatest extent by pruning neurons according to the threshold from the level of the entire test data set (such as the first test data set and the second test data set), while minimizing the impact on normal samples.

[0129] Determine the first number of times that the first activation state of the neuron is inactive and the second activation state is active; determine the second number of times that the first activation state of the neuron is active; and determine the ratio of the first number to the second number. In step S700, in some embodiments, the clearing of the backdoor neuron may include: pruning the backdoor neuron. Typically, pruning the backdoor neuron may include setting both the weight and bias of the backdoor neuron to 0. In this way, the pruning method is used instead of fine-tuning to achieve the clearing of the backdoor neuron without requiring additional training costs.

[0130] The embodiment of the present application reveals the attacker's intentions and strategies by reconstructing possible triggers and determines the backdoor neurons. It has a certain robustness to some variants of backdoor attacks, such as random triggers, multiple triggers, and multiple target labels. In addition, the present application only needs test set data to construct a conditional generative adversarial network without additional labeling costs; the removal of neurons uses pruning instead of fine-tuning, without additional training costs. The embodiment of the present application only requires one generator to achieve the purpose of judging the attack target, without the need to train multiple generators based on labels, which can reduce training costs.

[0131] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0132] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0133] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0134] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0135] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0136] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0137] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an image classification method.

[0138] refer to Figure 8 The image classification method may include:

[0139] S810, obtaining an image to be classified;

[0140] S820: Input the image to be classified into an image classification model obtained according to the backdoor defense method described in any of the previous embodiments to obtain the category of the image to be classified.

[0141] The image classification method of the above embodiment adopts the image classification model obtained by implementing the corresponding backdoor defense method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0142] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a backdoor defense device for an image classification model.

[0143] refer to Fig. 9 , the backdoor defense device 910 of the image classification model includes:

[0144] The first acquisition module 911 is configured to: acquire a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator;

[0145] The output module 912 is configured to: input the first label and the corresponding plurality of first random noises into the generator, and output a plurality of first disturbance quantities;

[0146] The first determination module 913 is configured to: determine whether the first label is an attack target label according to the similarity of the multiple first disturbance quantities;

[0147] The generating module 914 is configured to: in response to determining that the first label is an attack target label, generate a second test data set according to the first test data set and the plurality of first disturbance quantities;

[0148] The second determination module 915 is configured to: input the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model;

[0149] A third determination module 916 is configured to: input the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model;

[0150] The clearing module 917 is configured to: determine the backdoor neurons of the image classification model according to the first activation state and the second activation state, and clear the backdoor neurons.

[0151] In some embodiments, the first determining module is configured to:

[0152] Calculating similarity values ​​between each of the plurality of first disturbance quantities respectively;

[0153] Based on the similarity value, obtaining an average of the similarity values ​​between any two of the plurality of first disturbance quantities;

[0154] Based on the magnitude relationship between the mean and the threshold, it is determined whether the label is an attack target label.

[0155] In some embodiments, the first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity value includes the pixel similarity value or the Euclidean distance; and the first determination module is configured as follows:

[0156] In response to determining that the mean value is greater than a pixel similarity value threshold, determining that the tag is an attack target tag; or

[0157] In response to determining that the mean of the Euclidean distances is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label.

[0158] In some embodiments, the first test data set includes: a plurality of first test images; the second test data set includes: a plurality of second test images corresponding one-to-one to the plurality of first test images;

[0159] The clearing module is configured to: input a plurality of the first test images and a corresponding plurality of the second test images into the image classification model;

[0160] For any of the neurons, determine that the first activation state of the neuron is inactive and the second activation state is activated a first number of times; determine that the first activation state of the neuron is activated a second number of times; determine a ratio of the first number to the second number; and in response to determining that the ratio satisfies a preset threshold, determine that the neuron is the backdoor neuron.

[0161] In some embodiments, the first label is set to be multiple; the output module is configured to: input the first label and the corresponding multiple first random noises into the generator multiple times, and output multiple first disturbance quantities multiple times; wherein the first label input each time is different; the first label input each time corresponds to multiple first random noises; and / or

[0162] The cleaning module is configured to: prune the backdoor neurons; and / or

[0163] The generating module is configured to: add the multiple first disturbance quantities to the multiple first test images of the first test data set in a one-to-one correspondence, respectively, to obtain multiple second test images, that is, to obtain the second test data set.

[0164] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0165] The device of the above embodiment is used to implement the backdoor defense method of the corresponding image classification model in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0166] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an image classification device.

[0167] refer to Fig.10 , the image classification device 920 comprises:

[0168] The second acquisition module 921 is configured to: acquire an image to be classified;

[0169] The second generating module 922 is configured to: input the image to be classified into an image classification model to obtain the category of the image to be classified.

[0170] In some embodiments, the image classification model is obtained by the following backdoor defense method, which includes:

[0171] Obtain a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator;

[0172] Inputting a first label and a corresponding plurality of first random noises into the generator, and outputting a plurality of first disturbance quantities;

[0173] Determining whether the first label is an attack target label according to the similarities of the multiple first disturbance quantities;

[0174] In response to determining that the first label is an attack target label, generating a second test data set according to the first test data set and the plurality of first disturbance quantities;

[0175] Inputting the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model;

[0176] Inputting the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model;

[0177] According to the first activation state and the second activation state, a backdoor neuron of the image classification model is determined, and the backdoor neuron is cleared.

[0178] The determining, according to the similarities of the plurality of first disturbance quantities, whether the first label is an attack target label comprises:

[0179] Calculating similarity values ​​between each of the plurality of first disturbance quantities respectively;

[0180] Based on the similarity value, obtaining an average of the similarity values ​​between any two of the plurality of first disturbance quantities;

[0181] Based on the magnitude relationship between the mean and the threshold, it is determined whether the label is an attack target label.

[0182] In some embodiments, the first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity value includes the pixel similarity value or the Euclidean distance; and the determining whether the label is an attack target label based on the size relationship between the mean and the threshold value includes:

[0183] In response to determining that the mean value is greater than a pixel similarity value threshold, determining that the tag is an attack target tag; or

[0184] In response to determining that the mean of the Euclidean distances is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label.

[0185] In some embodiments, the first test data set includes: a plurality of first test images; the second test data set includes: a plurality of second test images corresponding one-to-one to the plurality of first test images;

[0186] The step of determining a backdoor neuron of the image classification model according to the first activation state and the second activation state includes:

[0187] Inputting a plurality of the first test images and a corresponding plurality of the second test images into the image classification model;

[0188] For any of the neurons, determine that the first activation state of the neuron is inactive and the second activation state is activated a first number of times; determine that the first activation state of the neuron is activated a second number of times; determine a ratio of the first number to the second number; and in response to determining that the ratio satisfies a preset threshold, determine that the neuron is the backdoor neuron.

[0189] In some embodiments, the first label is set to be multiple; the first label and the corresponding multiple first random noises are input into the generator, and the multiple first disturbances are output, including: the first label and the corresponding multiple first random noises are input into the generator multiple times, and the multiple first disturbances are output multiple times; wherein the first label input each time is different; the first label input each time corresponds to the multiple first random noises respectively; and / or

[0190] The clearing of the backdoor neurons comprises: pruning the backdoor neurons; and / or

[0191] Generating the second test data set according to the first test data set and the plurality of first disturbance quantities comprises: adding the plurality of first disturbance quantities one-to-one to the plurality of first test images of the first test data set, respectively, to obtain a plurality of second test images, namely, the second test data set.

[0192] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the backdoor defense method of the image classification model described in any of the above embodiments is implemented.

[0193] Fig.11A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0194] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0195] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0196] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0197] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0198] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0199] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0200] The electronic device of the above-mentioned embodiment is used to implement the backdoor defense method or image classification method of the corresponding image classification model in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0201] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the backdoor defense method or image classification method of the image classification model as described in any of the above embodiments.

[0202] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0203] The computer instructions stored in the storage medium of the above embodiments are used to enable the computer to execute the backdoor defense method or image classification method of the image classification model described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0204] Based on the same inventive concept, corresponding to the backdoor defense method of the image classification model or the image classification method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor executes the backdoor defense method of the image classification model or the image classification method. Corresponding to the execution subject corresponding to each step in each embodiment of the backdoor defense method of the image classification model or the image classification method, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0205] The computer program product of the above-mentioned embodiments is used to enable the computer and / or the processor to execute the backdoor defense method or image classification method of the image classification model as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0206] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0207] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0208] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0209] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A backdoor defense method for an image classification model, characterized in that: The backdoor defense method includes: Obtain a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator; Inputting a first label and a corresponding plurality of first random noises into the generator, and outputting a plurality of first disturbance quantities; Determining whether the first label is an attack target label according to the similarities of the multiple first disturbance quantities; In response to determining that the first label is an attack target label, generating a second test data set according to the first test data set and the plurality of first disturbance quantities; Inputting the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model; Inputting the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model; According to the first activation state and the second activation state, a backdoor neuron of the image classification model is determined, and the backdoor neuron is cleared.

2. The backdoor defense method of the image classification model according to claim 1 is characterized in that: The determining, according to the similarities of the plurality of first disturbance quantities, whether the first label is an attack target label comprises: Calculating similarity values ​​between each of the plurality of first disturbance quantities respectively; Based on the similarity value, obtaining an average of the similarity values ​​between any two of the plurality of first disturbance quantities; Based on the magnitude relationship between the mean and the threshold, it is determined whether the label is an attack target label.

3. The backdoor defense method of the image classification model according to claim 2 is characterized in that: The first disturbance amount includes the coordinates of the pixel point and the pixel value of the pixel point; the similarity value includes the pixel similarity value or the Euclidean distance; and the determining whether the label is an attack target label based on the size relationship between the mean and the threshold value includes: In response to determining that the mean value is greater than a pixel similarity value threshold, determining that the tag is an attack target tag; or In response to determining that the mean of the Euclidean distances is less than or equal to a Euclidean distance threshold, determining that the label is an attack target label.

4. The backdoor defense method of the image classification model according to claim 1, characterized in that: The first test data set includes: a plurality of first test images; the second test data set includes: a plurality of second test images corresponding one-to-one to the plurality of first test images; The step of determining a backdoor neuron of the image classification model according to the first activation state and the second activation state includes: Inputting a plurality of the first test images and a corresponding plurality of the second test images into the image classification model; For any of the neurons, determine that the first activation state of the neuron is inactive and the second activation state is activated a first number of times; determine that the first activation state of the neuron is activated a second number of times; determine a ratio of the first number to the second number; and in response to determining that the ratio satisfies a preset threshold, determine that the neuron is the backdoor neuron.

5. The backdoor defense method of the image classification model according to claim 1, characterized in that: The clearing of the backdoor neurons comprises: pruning the backdoor neurons; and / or Generating the second test data set according to the first test data set and the plurality of first disturbances comprises: adding the plurality of first disturbances to the plurality of first test images of the first test data set in a one-to-one correspondence, respectively, to obtain a plurality of second test images, that is, to obtain the second test data set; and / or The method further includes preprocessing the first test data set before generating a second test data set so that the first test data set does not include the first label.

6. An image classification method, characterized in that: include: Get the image to be classified; The image to be classified is input into an image classification model obtained by the backdoor defense method according to any one of claims 1 to 5 to obtain the category of the image to be classified.

7. A backdoor defense device for an image classification model, characterized in that: include: A first acquisition module is configured to: acquire a first test data set, an image classification model, a generator, a first label, and a plurality of first random noises corresponding to the first label; wherein the image classification model is a discriminator of the generator; An output module is configured to: input a first label and a corresponding plurality of first random noises into the generator, and output a plurality of first disturbance quantities; A first determination module is configured to: determine whether the first label is an attack target label according to the similarity of the plurality of first disturbance quantities; A generating module, configured to: in response to determining that the first label is an attack target label, generate a second test data set according to the first test data set and the plurality of first disturbance quantities; A second determination module is configured to: input the first test data set into the image classification model to determine a first activation state of a plurality of neurons of the image classification model; A third determination module is configured to: input the second test data set into the image classification model to determine a second activation state of a plurality of neurons of the image classification model; A clearing module is configured to: determine the backdoor neuron of the image classification model according to the first activation state and the second activation state, and clear the backdoor neuron.

8. An image classification device, characterized in that: include: The second acquisition module is configured to: acquire an image to be classified; The second generation module is configured to: input the image to be classified into the image classification model obtained by the backdoor defense method according to any one of claims 1 to 5 to obtain the category of the image to be classified.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the processor implements instructions of the backdoor defense method according to any one of claims 1 to 5 or the image classification method according to claim 6.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the backdoor defense method described in any one of claims 1 to 5 or the image classification method described in claim 6.

Images