Model backdoor reprogramming defense method and device, computer equipment and medium

Abstract

The invention relates to a model backdoor reprogramming defense method and device, computer equipment and a medium. The method comprises the following steps: inputting to-be-detected abnormal data marked with a label category in advance into a data preprocessing network in an abnormal data defense model to obtain basic feature data of the to-be-detected abnormal data; inputting the basic feature data into a data type identification network in an abnormal data defense model to obtain an initial type label corresponding to the to-be-detected abnormal data; and finding out a mapping type label under the initial type label corresponding to the to-be-detected abnormal data from the label mapping table, and taking the mapping type label as a target type label of the to-be-detected abnormal data. By adopting the method, the basic feature data can be identified through the data preprocessing network, the accuracy of benign data detection is preliminarily improved, label mapping is performed through the label mapping table, the abnormal data to be detected is identified as a correct type, and the defense accuracy of the abnormal data defense model is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence security technology, and in particular to a method, device, computer equipment and medium for reprogramming defense against model backdoors. Background Art

[0002] With the development of artificial intelligence security technology, a backdoor attack method has emerged. Backdoor attacks lurk inside the model by injecting malicious data or modifying model parameters during the model training process, causing the model to produce the attacker's expected output under specific trigger conditions. This type of attack is usually difficult to detect because the model can still perform the expected function under normal input.

[0003] To address this threat, traditional technologies typically use backdoor detection (using model behavior analysis or neuron activation pattern identification of suspicious triggers), model repair (by removing potential trigger mechanisms or retraining the model), input filtering (preprocessing input data to remove potential triggers) and authentication techniques (such as model watermarks and fingerprints) to avoid backdoor attacks.

[0004] Although this method can detect and mitigate backdoor attacks, attackers may design backdoors in more complex ways to circumvent existing defense mechanisms. Therefore, traditional defense technology still has the problem of inaccurate defense. Summary of the invention

[0005] Based on this, it is necessary to provide a reprogramming defense method, device, computer equipment and medium that can accurately defend against model backdoors in response to the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a model backdoor reprogramming defense method, comprising:

[0007] Input the abnormal data to be tested that are pre-labeled with label categories into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested;

[0008] Input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0009] Find out the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested; the abnormal data defense model defends against backdoor attacks by reprogramming.

[0010] In one embodiment, the abnormal data to be tested that is pre-labeled with a label category is input into a data preprocessing network in an abnormal data defense model to obtain basic feature data of the abnormal data to be tested, including:

[0011] Inputting the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested;

[0012] The abnormal characteristic data is eliminated from the abnormal data to be tested to obtain the basic characteristic data of the abnormal data to be tested.

[0013] In one embodiment, the label mapping table is constructed in the following manner:

[0014] Input the sample initial data into the data classification model to obtain the confidence of each type of label to which the sample initial data belongs;

[0015] Construct a label mapping table based on the two type labels ranked first in confidence;

[0016] Among them, the number of type labels is the same as the number of output interfaces of the data type identification network; the dimension of the type label is the same as the dimension corresponding to each output interface of the data type identification network.

[0017] In one embodiment, a label mapping table is constructed according to two type labels ranked first in confidence, including:

[0018] Select the preset abnormal label with the highest confidence from each type of label as the initial type label;

[0019] Select the preset normal label with the highest confidence from each type of label as the mapping type label;

[0020] A label mapping table is constructed according to the initial type label and the mapped type label.

[0021] In one embodiment, the training method of the abnormal data defense model includes:

[0022] Input the sample initial data into the standard type recognition model to obtain the first sample label;

[0023] Input the sample initial data into the abnormal data defense model to obtain the sample intermediate data and the second sample label; the sample intermediate data is the data obtained by inputting the sample data into the data preprocessing network in the abnormal data defense model;

[0024] The abnormal data defense model to be trained is trained according to the first sample label, the second sample label and the sample intermediate data.

[0025] In one embodiment, the abnormal data defense model to be trained is trained according to the first sample label, the second sample label and the sample intermediate data, including:

[0026] Get the intermediate sample labels corresponding to the sample intermediate data;

[0027] Determine a first loss value according to the first sample label and the intermediate sample label;

[0028] Determine a second loss value according to the first sample label and the second sample label;

[0029] According to the first loss value and the second loss value, the network parameters of the data preprocessing network in the abnormal data defense model are adjusted.

[0030] In a second aspect, the present application also provides a model backdoor reprogramming defense device, including:

[0031] A feature determination module is used to input the abnormal data to be tested that is pre-labeled with a label category into a data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested;

[0032] A type identification module is used to input basic feature data into a data type identification network in an abnormal data defense model to obtain an initial type label corresponding to the abnormal data to be tested;

[0033] The type mapping module is used to find out the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0034] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0035] Input the abnormal data to be tested that are pre-labeled with label categories into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested;

[0036] Input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0037] The mapped type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapped type label is used as the target type label of the abnormal data to be tested.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0039] Input the abnormal data to be tested that are pre-labeled with label categories into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested;

[0040] Input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0041] The mapped type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapped type label is used as the target type label of the abnormal data to be tested.

[0042] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0043] Input the abnormal data to be tested that are pre-labeled with label categories into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested;

[0044] Input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0045] The mapped type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapped type label is used as the target type label of the abnormal data to be tested.

[0046] The above-mentioned model backdoor reprogramming defense method, device, computer equipment and medium input the abnormal data to be tested that are pre-marked with label categories into the data preprocessing network in the abnormal data defense model to obtain the basic characteristic data of the abnormal data to be tested; input the basic characteristic data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested; find out the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested. The abnormal data to be tested in the present application may contain a trigger preset by the attacker. When the computer device identifies the abnormal data to be tested with the trigger as the abnormal type preset by the attacker, the trigger is triggered to attack the computer device. The present application identifies the basic characteristic data in the abnormal data to be tested through the data preprocessing network in the abnormal data defense model, preliminarily improves the accuracy of benign data detection in the abnormal data to be tested, and then uses the label mapping table to map the identified initial type label, identifies the abnormal data to be tested as the correct type, not the abnormal type preset by the attacker, and improves the defense accuracy of the abnormal data defense model. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] FIG1 is an application environment diagram of a model backdoor reprogramming defense method provided by this embodiment;

[0049] FIG2 is a schematic diagram of a flow chart of a first model backdoor reprogramming defense method provided in this embodiment;

[0050] FIG3 is a schematic diagram of reasoning of a model backdoor reprogramming defense model provided by this embodiment;

[0051] FIG4 is a schematic diagram of a process of constructing a label mapping table provided in this embodiment;

[0052] FIG5 is a flow chart of a training model backdoor reprogramming defense model provided in this embodiment;

[0053] FIG6 is an overview diagram of a model backdoor reprogramming defense model training process provided by this embodiment;

[0054] FIG7 is a structural block diagram of a model backdoor reprogramming defense device provided in this embodiment;

[0055] FIG8 is a diagram showing the internal structure of a computer device provided in this embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] The model backdoor reprogramming defense method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The computer device inputs the abnormal data to be tested that is pre-marked with the label category into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested; the basic feature data is input into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested; the mapping type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapping type label is used as the target type label of the abnormal data to be tested. Among them, the computer device can be both a terminal and a server. The terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0058] In an exemplary embodiment, as shown in FIG2 , a model backdoor reprogramming defense method is provided, which is described by taking the method applied to the computer device in FIG1 as an example, and includes the following steps 201 to 203. Among them:

[0059] Step 201 : input the abnormal data to be tested that are pre-marked with label categories into the data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested.

[0060] The label category may be a label category corresponding to the type of abnormal data to be tested. The abnormal data may be data implanted with a trigger by an attacker. The abnormal data to be tested may be data to be detected that may contain abnormal data. The abnormal data defense model may be a backdoor defense framework based on model reprogramming (Backdoor Defense via Model Reprogramming, BD-MR). The basic feature data may be data from the abnormal data to be tested with abnormal feature data removed.

[0061] The data preprocessing network may be a network layer for preprocessing abnormal data to be detected. The number of input channels and the number of output channels of the data preprocessing network are the same, and the structure of the data preprocessing network may be similar to or the same as an autoencoder, a neural network (UNet), a diffusion model, etc.

[0062] One optional implementation method may be to input the abnormal data to be tested into a data preprocessing network in an abnormal data defense model; for each abnormal data to be tested, the data preprocessing network identifies whether there is a trigger in the abnormal data to be tested; if there is a trigger, the data preprocessing network eliminates the trigger in the abnormal data to be tested, and uses the abnormal data to be tested after the trigger is eliminated as basic feature data; if there is no trigger, the data preprocessing network identifies the abnormal data to be tested as benign data, adds a benign label to the benign data, and uses the benign data with the benign label as the basic feature data.

[0063] Another optional implementation method may be to input the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested; remove the abnormal feature data from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

[0064] Specifically, the abnormal data to be tested is input into the data preprocessing network in the abnormal data defense model, the abnormal feature data in the abnormal data to be tested is extracted and identified through the data preprocessing network, the abnormal feature data in the abnormal data to be tested is deleted, and the abnormal data to be tested without the abnormal feature data is used as the basic feature data.

[0065] Step 202: input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested.

[0066] The data type identification network may be a network level set according to a backdoor defense model. The initial type label may be an initial label determined according to the abnormal data to be tested, and the initial type label may be a type label corresponding to the abnormal type preset by the attacker.

[0067] Specifically, the basic feature data is input into a data type recognition network in the abnormal data defense model, and the data type recognition network recognizes the type label of the basic feature data to obtain an initial type label corresponding to the abnormal data to be tested.

[0068] Step 203: Find out the mapped type label under the initial type label corresponding to the abnormal data to be detected from the label mapping table, and use the mapped type label as the target type label of the abnormal data to be detected.

[0069] Among them, the label mapping table can be a table storing the mapping relationship between the initial type label and the mapping type label, and the mapping relationship can be pre-set. The mapping type label can avoid the triggering of the trigger. The target type label can be the real type label of the abnormal data to be tested. For example, assuming that the real type label of the abnormal data to be tested is an airplane, when the real type label of the abnormal data to be tested is modified to a truck, the initial type label of the abnormal data to be tested identified by the data type recognition network may be a truck. After label mapping is performed through the label mapping table, the truck can be mapped to an airplane, that is, the target type label obtained is the real type label of the abnormal data to be tested.

[0070] Among them, the abnormal data defense model defends against backdoor attacks by reprogramming. The reprogramming method can be to add an input transformation module (i.e., a data preprocessing network) and an output mapping module (i.e., a label mapping table) on the basis of the original model (i.e., the data type recognition network) to defend the original model against backdoor attacks.

[0071] Optionally, in this embodiment, the initial type label can be used as the output of the abnormal data defense model, and the computer device obtains the initial type label of the abnormal data to be tested, finds the mapped type label under the initial type label from the label mapping table, and uses the mapped type label as the target type label of the abnormal data to be tested. In this embodiment, the initial type label can also be used as the output of the data type recognition network in the abnormal data defense model, finds the mapped type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table in the abnormal data defense model, and uses the mapped type label as the target type label of the abnormal data to be tested.

[0072] For example, the reasoning diagram of the abnormal data defense model is shown in FIG3. In the figure, the benign sample is the sample data without the trigger, the attacked sample is the sample data with the trigger implanted in the benign sample, the BD-MR framework is the abnormal data defense model, the data preprocessing module is the data preprocessing network in the abnormal data defense model, the backdoor model is the data type identification network in the abnormal data defense model, and the label mapping relationship is the label mapping table in the abnormal data defense model. If only the benign sample is input into the backdoor model, the predicted label is truck, that is, the real type label of the benign sample is truck; if only the attacked sample (the attacked sample can be a sample attacked by the backdoor) is input into the backdoor model, the target label is airplane, that is, if the type label of the attacked sample is identified as airplane, the trigger will be activated; and after the attacked sample is input into the BD-MR framework, the predicted label is truck. It can be seen that the BD-MR framework can accurately identify the real type label of the attacked sample, rather than the type label preset by the attacker.

[0073] It should be noted that, for basic feature data carrying benign labels, this embodiment can directly use the initial type label corresponding to the basic feature data carrying benign labels as the target type label without the need for mapping through a label mapping table.

[0074] The above-mentioned model backdoor reprogramming defense method inputs the abnormal data to be tested that is pre-marked with a label category into the data preprocessing network in the abnormal data defense model to obtain the basic feature data of the abnormal data to be tested; inputs the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested; finds the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and uses the mapping type label as the target type label of the abnormal data to be tested. The abnormal data to be tested in the present application may contain a trigger preset by the attacker. When the computer device identifies the abnormal data to be tested with the trigger as the abnormal type preset by the attacker, the trigger is triggered to attack the computer device. The present application identifies the basic feature data in the abnormal data to be tested through the data preprocessing network in the abnormal data defense model, preliminarily improves the accuracy of benign data detection in the abnormal data to be tested, and then uses the label mapping table to map the identified initial type label, identifies the abnormal data to be tested as the correct type, not the abnormal type preset by the attacker, improves the defense accuracy of the abnormal data defense model, and further does not need to consider the specific trigger mode of the backdoor to effectively reduce the success rate of the backdoor attack.

[0075] In an exemplary embodiment, as shown in FIG4 , a flow chart of constructing a label mapping table is provided, and the method is applied to the computer device in FIG1 as an example for explanation, including the following steps 401 to 402. The label mapping table is constructed in the following manner:

[0076] Step 401: Input the sample initial data into the data classification model to obtain the confidence of each type of label to which the sample initial data belongs.

[0077] The sample initial data may be sample data used as a training abnormal data defense model. Optionally, the sample initial data may be unlabeled sample initial data, and the sample initial data does not contain a trigger. The data classification model may be a model for classifying the sample initial data. The number of type labels is the same as the number of output interfaces of the data type recognition network; the dimension of the type label is the same as the dimension corresponding to each output interface of the data type recognition network.

[0078] Specifically, the sample initial data is obtained; the sample initial data is input into the data classification model, and for each output interface of the data classification model, the confidence of the type label corresponding to the output interface is determined.

[0079] Step 402: construct a label mapping table according to the two type labels with the highest confidence rankings.

[0080] One optional implementation method may be to obtain two type labels with top confidence rankings, randomly set a mapping relationship between the two type labels, and construct a label mapping table with the set mapping relationship.

[0081] Another optional implementation method may be to select the preset abnormal label with the highest confidence from each type of label as the initial type label; select the preset normal label with the highest confidence from each type of label as the mapping type label; and construct a label mapping table based on the initial type label and the mapping type label.

[0082] Specifically, the preset abnormal label with the highest confidence is selected from each type of label as the initial type label; the preset normal label with the highest confidence is selected from each type of label as the mapping type label; the initial type label and the mapping type label are associated to form a mapping relationship, and all mapping relationships are stored in a label mapping table.

[0083] For example, taking the CIFAR-10 dataset as the sample initial data, the output interface of the data type recognition network is a 10-channel confidence score, and each channel represents the classification score of each category. Usually, the categories represented by the 10 channels are airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships, and trucks; after setting the label mapping relationship, the categories represented by the 10 channels may become as follows (representing only one case): birds, horses, dogs, cars, cats, airplanes, trucks, ships, frogs, and deer. The label mapping relationship of the above example is:

[0084]

[0085] In this embodiment, the sample initial data is input into the data classification model to obtain the confidence of each type of label to which the sample initial data belongs, and a label mapping table is constructed based on the two types of labels with the highest confidence rankings. This embodiment can more accurately construct a label mapping table through the confidence of each type of label.

[0086] In an exemplary embodiment, as shown in FIG5 , a flow chart of training an abnormal data defense model is provided, and the method is applied to the computer device in FIG1 as an example for explanation, including the following steps 501 to 503. Among them:

[0087] Step 501: Input the sample initial data into the standard type recognition model to obtain the first sample label.

[0088] Among them, the model structure of the standard type recognition model can be the same as the network structure of the data preprocessing network in the abnormal data defense model, and the standard type recognition model can be used to identify the true type label of the sample initial data.

[0089] Specifically, the sample initial data is input into the standard type recognition model, and the standard type recognition model performs recognition processing on the type label of the sample initial data to obtain a first sample label.

[0090] Step 502: Input the sample initial data into the abnormal data defense model to obtain the sample intermediate data and the second sample label.

[0091] Among them, the sample intermediate data is the data obtained by inputting the sample data into the data preprocessing network in the abnormal data defense model.

[0092] Specifically, the sample initial data is input into the abnormal data defense model, and the data preprocessing network in the abnormal data defense model preprocesses the sample initial data to obtain the sample intermediate data; the sample data is input into the data type recognition network in the abnormal data defense model to obtain the sample type label corresponding to the abnormal data to be tested; the mapping type label of the sample type label is found from the label mapping table, and the mapping type label is used as the second type label of the sample initial data.

[0093] It should be noted that before the sample initial data is input into the abnormal data defense model, the sample initial data must be normalized according to the input interface of the abnormal data defense model.

[0094] Step 503: Perform model training on the abnormal data defense model to be trained according to the first sample label, the second sample label and the sample intermediate data.

[0095] One optional implementation method may be to determine the target loss value according to the first sample label, the second sample label and the sample intermediate data by the following formula (1-1), and perform model training on the abnormal data defense model to be trained according to the loss value.

[0096] (1-1)

[0097] Among them, x represents the sample initial data, y represents the first sample label, and F δ Represents the abnormal data defense model, Pre δ represents the data preprocessing network in the abnormal data defense model, CE represents the cross entropy loss, and SC represents the supervised contrast loss.

[0098] Another optional implementation method may be to obtain the intermediate sample label corresponding to the sample intermediate data; determine the first loss value according to the first sample label and the intermediate sample label; determine the second loss value according to the first sample label and the second sample label; and adjust the network parameters of the data preprocessing network in the abnormal data defense model according to the first loss value and the second loss value. The first loss value may be a supervised contrast loss value, and the second loss value may be a cross entropy loss value.

[0099] Specifically, the intermediate sample label corresponding to the intermediate data of the sample is obtained; the supervised contrast loss value between the first sample label and the intermediate sample label is determined as the first loss value; the cross entropy loss value between the first sample label and the second sample label is determined as the second loss value; according to the sum of the first loss value and the second loss value, the target loss value is determined, and the network parameters of the data preprocessing network in the abnormal data defense model are adjusted according to the target loss value.

[0100] It should be noted that in this embodiment, the parameter weights of the data preprocessing network in the abnormal data defense model are randomly initialized. Stochastic gradient descent is used as the optimization strategy, and the learning rate is 0.01. By default, the upper limit of the training process is 200 times, and the learning rate is adjusted down to 0.1 times at the 100th and 150th times respectively.

[0101] For example, FIG6 is an overview of the training process of the abnormal data defense model, in which the unlabeled sample is the sample initial data, the data preprocessing module is the data preprocessing network in the abnormal data defense model, the backdoor model is the data type recognition network in the abnormal data defense model, and the label mapping relationship is the label mapping table in the abnormal data defense model. According to the intermediate samples and the predicted labels, the supervised contrast loss is determined; according to the confidence score and the predicted label, the cross entropy loss is determined; according to the supervised contrast loss and the cross entropy loss, the network parameters of the data preprocessing module are adjusted by back propagation.

[0102] In this embodiment, the sample initial data is input into the standard type recognition model to obtain the first sample label, and the sample initial data is input into the abnormal data defense model to obtain the sample intermediate data and the second sample label; the abnormal data defense model to be trained is trained according to the first sample label, the second sample label and the sample intermediate data. In this embodiment, only the unlabeled sample initial data is used to complete the training of the abnormal data defense model (especially the data preprocessing network in the abnormal data defense model), and the trigger mode is effectively eliminated. At the same time, while effectively reducing the success rate of backdoor attacks, it also ensures that the benign accuracy of the abnormal data defense model is maintained at a high level, which is better than the traditional method.

[0103] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a model backdoor reprogramming defense device for implementing the model backdoor reprogramming defense method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more model backdoor reprogramming defense devices provided below can refer to the limitations of the model backdoor reprogramming defense method above, and will not be repeated here.

[0105] In an exemplary embodiment, as shown in FIG7 , a model backdoor reprogramming defense device is provided, comprising: a feature determination module 10, a type identification module 11 and a type mapping module 12, wherein:

[0106] The feature determination module 10 is used to input the abnormal data to be tested that is pre-labeled with a label category into the data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested;

[0107] The type identification module 11 is used to input the basic feature data into the data type identification network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0108] The type mapping module 12 is used to find out the mapped type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapped type label as the target type label of the abnormal data to be tested.

[0109] In some embodiments, the feature determination module 10 in Figure 7 is also used to input the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested; eliminate the abnormal feature data from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

[0110] In some embodiments, the reprogramming defense device of the model backdoor in FIG. 7 further includes:

[0111] A mapping construction module is used to input the sample initial data into the data classification model to obtain the confidence of each type label to which the sample initial data belongs; a label mapping table is constructed according to the two type labels ranked first in confidence; wherein the number of type labels is the same as the number of output interfaces of the data type recognition network; and the dimension of the type label is the same as the dimension corresponding to each output interface of the data type recognition network.

[0112] In some embodiments, the mapping construction module in Figure 7 is also used to select the preset abnormal label with the highest confidence from each type of label as the initial type label; select the preset normal label with the highest confidence from each type of label as the mapping type label; and construct a label mapping table based on the initial type label and the mapping type label.

[0113] In some embodiments, the reprogramming defense device of the model backdoor in FIG. 7 further includes:

[0114] The model training module is used to input the sample initial data into the standard type recognition model to obtain the first sample label; input the sample initial data into the abnormal data defense model to obtain the sample intermediate data and the second sample label; the sample intermediate data is the data obtained by inputting the sample data into the data preprocessing network in the abnormal data defense model; according to the first sample label, the second sample label and the sample intermediate data, the abnormal data defense model to be trained is trained.

[0115] In some embodiments, the model training module in Figure 7 is also used to obtain the intermediate sample label corresponding to the sample intermediate data; determine the first loss value based on the first sample label and the intermediate sample label; determine the second loss value based on the first sample label and the second sample label; adjust the network parameters of the data preprocessing network in the abnormal data defense model based on the first loss value and the second loss value.

[0116] Each module in the reprogramming defense device of the model backdoor can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0117] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG8. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a reprogramming defense method for a model backdoor is implemented.

[0118] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0121] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0122] It should be noted that the data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0123] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0124] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A model backdoor reprogramming defense method, characterized in that: The method comprises: Inputting the abnormal data to be tested that are pre-labeled with label categories into the data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested; Inputting the basic feature data into a data type recognition network in an abnormal data defense model to obtain an initial type label corresponding to the abnormal data to be tested; Find out the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested; the abnormal data defense model defends against backdoor attacks by reprogramming.

2. The method according to claim 1, characterized in that The method of inputting the abnormal data to be tested, which is pre-labeled with a label category, into a data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested includes: Inputting the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested; The abnormal characteristic data is removed from the abnormal data to be detected to obtain basic characteristic data of the abnormal data to be detected.

3. The method according to claim 1, characterized in that The label mapping table is constructed in the following manner: Input the sample initial data into the data classification model to obtain the confidence of each type of label to which the sample initial data belongs; Construct a label mapping table based on the two type labels ranked first in confidence; Among them, the number of the type tags is the same as the number of output interfaces of the data type identification network; the dimension of the type tag is the same as the dimension corresponding to each output interface of the data type identification network.

4. The method according to claim 3, characterized in that The label mapping table is constructed according to the two type labels ranked first in confidence, including: Selecting a preset abnormal label with the highest confidence from each of the type labels as an initial type label; Selecting a preset normal label with the highest confidence from each of the type labels as a mapping type label; The label mapping table is constructed according to the initial type label and the mapped type label.

5. The method according to claim 1, characterized in that The training methods of the abnormal data defense model include: Input the sample initial data into the standard type recognition model to obtain the first sample label; Inputting the sample initial data into the abnormal data defense model to obtain sample intermediate data and a second sample label; the sample intermediate data is data obtained by inputting the sample data into the data preprocessing network in the abnormal data defense model; Model training is performed on the abnormal data defense model to be trained according to the first sample label, the second sample label and the sample intermediate data.

6. The method according to claim 5, characterized in that The performing model training on the abnormal data defense model to be trained according to the first sample label, the second sample label and the sample intermediate data includes: Get the intermediate sample labels corresponding to the sample intermediate data; Determine a first loss value according to the first sample label and the intermediate sample label; Determine a second loss value according to the first sample label and the second sample label; According to the first loss value and the second loss value, network parameters of the data preprocessing network in the abnormal data defense model are adjusted.

7. A model backdoor reprogramming defense device, characterized in that: The device comprises: A feature determination module is used to input the abnormal data to be tested that is pre-labeled with a label category into a data preprocessing network in the abnormal data defense model to obtain basic feature data of the abnormal data to be tested; A type identification module, used to input the basic feature data into a data type identification network in an abnormal data defense model to obtain an initial type label corresponding to the abnormal data to be tested; The type mapping module is used to find out the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images