Back door defense method based on causal diffusion model

Abstract

The invention relates to a back door defense method based on a causal diffusion model, and belongs to the field of back door attack defense based on a data set. Comprising the following steps: defining a structural causal model, eliminating a trigger through a causal diffusion model, and de-mixing false association between an image and a label caused by noise or distribution of data in a reverse denoising process; predicting probability distribution by using a label of an image generated by a causal diffusion model, calculating KL divergence, and then comparing with a threshold value to identify a poisoning sample; for the identified poisoning samples, a data set is purified by constructing a candidate set and by selecting a purified image from the candidate set in consideration of pixels and feature distances. According to the method, causal reasoning is introduced into the diffusion model to purify the data set, the back door criterion based on causal intervention is applied to eliminate hybrid deviation in the diffusion model reverse denoising process, and it is ensured that the model can eliminate the influence of false correlation to achieve effective purification of the poisoning data set.

Description

Technical Field

[0001] The present invention belongs to the field of backdoor attack defense based on data sets, and specifically relates to a backdoor defense method based on a causal diffusion model. Background Art

[0002] Among all the deep learning security issues, backdoor attacks have been a hot research topic since they were proposed in 2017 and will become a major potential threat. Recent studies have shown that deep neural networks (DNNs) are vulnerable to backdoor attacks, where attackers inject backdoors into DNNs by poisoning some training data. Specifically, backdoor attackers attach backdoor triggers to some benign data and change their labels to target labels specified by the attacker, turning them into poisoned datasets. However, DNN models require a large amount of diverse and high-quality data for training, so the risk of backdoor attacks hinders the application of DNNs in some safety-critical fields, such as autonomous driving, facial recognition, and medical image analysis.

[0003] Causal inference is a method of explaining model behavior by identifying and understanding the causal relationships between variables, especially when there are confounding factors, to determine causal relationships that are difficult to identify. It has been widely used in many fields such as medical diagnosis, economic forecasting, and policy evaluation, helping people to more accurately understand and predict the real drivers of results. In addition, the human cognitive system is naturally immune to input perturbations (such as trigger patterns caused by backdoor attacks) because humans are more sensitive to causal relationships than simple statistical correlations.

[0004] Mengara et al. (A backdoor approach within inverted labels using dirty label-flipping attacks, 2024) proposed a backdoor attack method called "DirtyFlipping", which embeds triggers into target category data through label flipping, thereby achieving covert attacks. In clean label attacks, triggers are introduced into training data without changing sample labels, and all labels remain correct (i.e., "clean" labels). Zhao et al. (Defeat: Deeply perceived feature backdoor attacks by imperceptible perturbation and latent representation constraints, 2022, 15192-15201) proposed an optimization method that poisons data by cross-entropy measurement to generate adaptive and imperceptible perturbations, thereby limiting the potential representation of poisoned data during training, enhancing the stealth of attacks and resistance to defense mechanisms. To defend against backdoor attacks based on poisoned datasets, especially those involving dirty labels, Zhou et al. (Dataelixir: Purifying poisoned dataset to trigger backdoor attacks via diffusion models, 2024, 21850-21858) proposed DATAELIXIR, which uses diffusion models to iteratively remove trigger features and restore benign features. Zhang et al. (Backdoor defense via deconfounded representation learning, 2023, 12228-122238) proposed a backdoor defense method based on causal reasoning, called deconfused representation learning (CBD). This method constructs a causal graph to separate confounding effects, thereby achieving a purer causal representation. It focuses on extracting true causal effects by training one model to capture confounding factors and another model to minimize their impact.

[0005] Although the diffusion model provides a new idea for purifying poisoned datasets, they do not take into account the false positives that may be caused by the diffusion model during the label conversion process, which leads to inaccurate target label prediction and misclassification and unreliable purification process. Therefore, designing a method that can explain the real reasons for the poisoned data purification process and analyze the false associations caused by backdoor attack triggers and noise distribution as confounding factors between poisoned images and predicted labels has become a technical problem that needs to be solved urgently by technicians in this field. Summary of the invention

[0006] The purpose of the present invention is to provide a backdoor defense method based on a causal diffusion model, introduce causal reasoning into the diffusion model purification data set, apply the backdoor criterion based on causal intervention to eliminate the confounding bias in the reverse denoising process of the diffusion model, and ensure that the model can eliminate the influence of false correlations to achieve effective purification of the poisoned data set.

[0007] To achieve the above object, the technical solution of the present invention is: a backdoor defense method based on a causal diffusion model, comprising:

[0008] S1. Define a structural causal model, eliminate triggers through the causal diffusion model, and unmix the spurious associations between images and labels caused by the noise or distribution of the data itself in the reverse denoising process;

[0009] S2, using the causal diffusion model to generate the label prediction probability distribution of the image, after calculating the KL divergence, identify the poisoned samples by comparing with the threshold;

[0010] S3. For the identified poisoned samples, the dataset is purified by constructing a candidate set and selecting purified images from the candidate set considering pixel and feature distances.

[0011] In one embodiment of the present invention, step S1 includes the following steps:

[0012] S1-1. Define the structural causal model and obtain the three paths of the structural causal graph as follows:

[0013] B→Z→M→Y

[0014] B→X→M→Y

[0015] X→Y

[0016] Among them, B represents the trigger, X represents the image in the data set, Z represents the confounding factor, that is, the noise or distribution of the data itself, M represents the feature of anomaly recognition, and Y represents the predicted label;

[0017] S1-2, the forward process q starts from the original image x0 and gradually adds Gaussian noise to finally generate a noisy image x T ;

[0018] S1-3. Use the process p opposite to the forward process q θ To gradually restore the benign characteristics, that is, from x T Return to x0 to produce the purified image

[0019] S1-4. In each round of reverse denoising in the causal diffusion model, after the causal diffusion model estimates the current noise, the noise is removed from the current image feature Subtract it from the original image to get an updated feature representation that is closer to noise-free. The process is as follows:

[0020]

[0021] S1-5. Using causal intervention to eliminate the influence of confounding factor Z, the process of backdoor adjustment calculation and prediction label distribution is expressed as:

[0022]

[0023] in, Indicates that given the input image features Abnormal features t The conditional probability of label Y under the condition of and noise z; P(z) represents the marginal distribution of noise z;

[0024] S1-6, Re-stated as a model The calculated Softmax output is:

[0025]

[0026] S1-7, the process of approximately calculating the expected value of S1-6 is expressed as:

[0027]

[0028] S1-8, E z Expensive sampling calculations are required. To simplify the calculations, the normalized weighted geometric mean NWGM is introduced to approximate the expectations of steps S1-7. The overall process is expressed as:

[0029]

[0030] S1-9, blocking the backdoor path gives X a fair chance to include each Z in the prediction of Y; f(~) is defined as follows:

[0031]

[0032] Among them, W1 and W2 are the parameter matrices of the model, is a constant scaling factor for feature normalization; at time step t, using the estimated m t Features Perform causal adjustments to generate adjusted features The overall process is expressed as:

[0033]

[0034] Among them, α is an adjustment coefficient used to control the intensity of causal intervention.

[0035] In one embodiment of the present invention, in step S1-2, the amount of noise added in each step is In x t-1 Generate image x under the condition T The process is expressed as the following formula:

[0036]

[0037] in, is the scaling factor; N is the symbol of Gaussian distribution; The mean of the image generated by the Gaussian distribution at step t; β t I represents the covariance matrix of the image generated in step t, which represents the noise added in each step. I is the unit matrix, which means that the noise is isotropic. This step ensures the gradual blurring of the image in the forward process and eliminates the triggering features. The overall probability distribution of the forward process is as follows:

[0038]

[0039] In one embodiment of the present invention, the overall process of step S1-3 is expressed as follows:

[0040]

[0041] p θ (x t-1 |x t ):=N(x t-1 ;u θ (x t ,t),∑ θ (x t ,t))

[0042] Among them, the mean u θ (x t ,t) is learned by a parameterized neural network, the variance ∑ θ (x t , t) is a time step related constant or learned by the neural network, and N is the symbol of the Gaussian distribution.

[0043] In one embodiment of the present invention, step S2 includes the following steps:

[0044] S2-1, for the label probability distribution in step S1-5, select the image X0 generated at the last time step t=0 of the causal diffusion model for analysis, input the images generated by multiple rounds of iterations into the classifier model, and calculate the label probability distribution P(Y|X0) of the final generated image X0;

[0045] S2-2, perform multiple rounds of independent reverse denoising processes on the same image, and record P(Y|X0) in step S2-1 each time to obtain P n (Y|X0), where n is the number of iterations;

[0046] S2-3, taking the average of the label probability distribution of n iterations of step S2-2, the process of obtaining the average probability distribution is expressed as follows:

[0047]

[0048] S2-4. Use KL divergence to measure the difference between the label probability distribution and the average probability distribution of each iteration. The whole process is expressed as follows:

[0049]

[0050] Among them, C is the total number of label categories, Y i is the probability of the i-th label;

[0051] S2-5, aggregate the differences of all iterations of step S2-4 to obtain the aggregated difference amount The overall process is shown as follows:

[0052]

[0053] S2-6, define the threshold τ, when the sample When it is less than the threshold τ, it is marked as a normal sample; otherwise, When the threshold τ is exceeded, the sample is marked as an abnormal sample, thereby dividing the samples in the original data set D into a benign set B and a poisoned set P.

[0054] In one embodiment of the present invention, in step S2-1, P(Y|X0) is expressed as follows:

[0055] P(Y|X0)=Softmax(W*X0+b)

[0056] Among them, W and b are the weight and bias of the classifier, and P(Y|X0) represents the probability that image X0 belongs to each category.

[0057] In one embodiment of the present invention, step S3 includes the following steps:

[0058] S3-1, construct the sample images finally generated by multiple rounds of iterations into a candidate set C(X i ,Y i ), select a sample in C that is similar to the original sample X i X with large difference j As X i After cleaning, quantize X i and Xj The process of distance between them is as follows:

[0059]

[0060] Among them, MSE is the mean square error, which quantifies the error by calculating the average of the square of the difference between the predicted value and the true value, and the cosine similarity Represents characteristics after causal intervention Cosine similarity in vector space;

[0061] S3-2, based on the metric in step S3-1, select from the candidate set C the sample that matches the original sample X i X with large difference j , and obtain the purified sample The overall process is shown as follows:

[0062]

[0063] In one embodiment of the present invention, in step S3-1, the cosine similarity Quantize X by the dot product of the eigenvectors i and X j The similarity between them is defined as follows:

[0064]

[0065] The present invention also provides a backdoor defense system for purifying data sets based on a causal enhancement diffusion model, comprising a memory, a processor, and computer program instructions stored in the memory and capable of being executed by the processor. When the processor executes the computer program instructions, the method steps described above can be implemented.

[0066] The present invention also provides a computer-readable storage medium, on which computer program instructions that can be executed by a processor are stored. When the processor executes the computer program instructions, the method steps described above can be implemented.

[0067] Compared with the prior art, the present invention has the following beneficial effects: The present invention proposes a causal diffusion model for purifying poisoned datasets based on causal reasoning, discovers the mechanism by which backdoor attack triggers and noise distribution as confounding factors induce false associations between poisoned images and predicted labels, and reveals its backdoor path. Through experiments on three popular backdoor attacks, it demonstrates its significant effect in reducing the impact of backdoor attacks while maintaining high prediction accuracy for benign samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 The figure is an overall flow chart of a backdoor defense method based on a causal diffusion model according to an embodiment of the present invention;

[0069] Figure 2 A specific flow chart of a causal enhancement diffusion model of a backdoor defense method based on a causal diffusion model according to an embodiment of the present invention;

[0070] Figure 3 The present invention is a flowchart of a backdoor defense method based on a causal diffusion model for purifying a poisoned data set in an embodiment of the present invention. DETAILED DESCRIPTION

[0071] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0072] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0073] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0074] like Figures 1 to 3 As shown in one, this embodiment provides a backdoor defense method based on a causal diffusion model, which includes the steps of:

[0075] S1. Define a structural causal model, eliminate triggers through the causal diffusion model, and unmix the spurious associations between images and labels caused by the noise or distribution of the data itself in the reverse denoising process;

[0076] S2, using the causal diffusion model to generate the label prediction probability distribution of the image, after calculating the KL divergence, identify the poisoned samples by comparing with the threshold;

[0077] S3. For the identified poisoned samples, the dataset is purified by constructing a candidate set and selecting purified images from the candidate set considering pixel and feature distances.

[0078] Furthermore, step S1 specifically includes the following steps:

[0079] S1-1. Define the structural causal model and obtain the three paths of the structural causal graph as follows:

[0080] B→Z→M→Y

[0081] B→X→M→Y

[0082] X→Y

[0083] Among them, B represents the trigger, X represents the image in the data set, Z represents the confounding factor (the noise or specific distribution of the data itself), M represents the feature of anomaly recognition, and Y represents the predicted label;

[0084] S1-2, the forward process q starts from the original image x0 and gradually adds Gaussian noise to finally generate a noisy image x T The amount of noise added at each step is In x t-1 Generate image x under the condition T The process is the following formula:

[0085]

[0086] in, is the scaling factor, N is the symbol of the Gaussian distribution, The mean of the image generated by the Gaussian distribution at step t. t I represents the covariance matrix of the image generated in step t, represents the noise added in each step, and I is the unit matrix, indicating that the noise is isotropic. This step ensures the gradual blurring of the image in the forward process and eliminates the triggering features.

[0087] Furthermore, the overall probability distribution of the forward process is expressed as follows:

[0088]

[0089] S1-3, using the opposite process p θ To gradually restore the benign features (from x T Return to x0), and produce the purified image

[0090]

[0091] p θ (x t-1 |x t ):=N(x t-1 ;u θ (x t ,t),∑ θ (x t ,t))

[0092] Among them, the mean u θ (x t ,t) is learned by a parameterized neural network, the variance ∑ θ (x t ,t) can be a time step related constant or can be learned by a neural network, and N is the symbol of the Gaussian distribution.

[0093] S1-4, in each round of reverse denoising of the diffusion model, when the model estimates the current noise, the noise is removed from the current image feature Subtract it from the original image to get an updated feature representation that is closer to noise-free. The specific representation is as follows:

[0094]

[0095] S1-5. Using causal intervention to eliminate the influence of confounding factor Z, the formula for backdoor adjustment calculation of predicted label distribution is expressed as follows:

[0096]

[0097] in, Indicates that given the input image features Abnormal features t The conditional probability of label Y under the condition of and noise z; P(z) represents the marginal distribution of noise z.

[0098] S1-6, Re-stated as a model The calculated Softmax output is:

[0099]

[0100] S1-7, the process of approximately calculating the expected value of S1-6 is expressed as:

[0101]

[0102] S1-8, E z Requires expensive sampling calculations. In order to simplify the calculation, the normalized weighted geometric mean (NWGM) is introduced to approximate the above expectation. In short, NWGM effectively transfers the external expectation to Softmax, and the process is expressed as:

[0103]

[0104] S1-9. Blocking backdoor paths gives X a fair chance to include each Z in the prediction of Y. f(~) is defined as follows:

[0105]

[0106] Among them, W1 and W2 are the parameter matrices of the model, is a constant scaling factor for feature normalization.

[0107] Furthermore, at time step t, using the estimated m t Features Perform causal adjustments to generate adjusted features The process is expressed as:

[0108]

[0109] Among them, α is an adjustment coefficient used to control the intensity of causal intervention.

[0110] Furthermore, step S2 specifically includes the following steps:

[0111] S2-1. For the label probability distribution in S1-5, select the image X0 generated by the last time step t=0 of the diffusion model for analysis, input the images generated by multiple rounds of iterations into the classifier model, and calculate the label probability distribution P(Y|X0) of the final generated image X0 as follows:

[0112] P(Y|X0)=Softmax(W*X0+b)

[0113] Among them, W and b are the weight and bias of the classifier, and P(Y|X0) represents the probability that image X0 belongs to each category.

[0114] S2-2, perform multiple rounds of independent reverse denoising processes on the same image, and record P(Y|X0) in step S2-1 each time to obtain P n (Y|X0), where n is the number of iterations.

[0115] S2-3, take the average of the label probability distribution of n iterations of step S2-2, and obtain the formula of the average probability distribution as follows:

[0116]

[0117] S2-4. Use KL divergence to measure the difference between the label probability distribution of each iteration and the average probability distribution. The expression is as follows:

[0118]

[0119] Among them, C is the total number of label categories, Y i is the probability of the i-th class label.

[0120] S2-5, aggregate the differences of all iterations of step S2-4 to obtain the aggregated difference amount The expression to be calculated is as follows:

[0121]

[0122] S2-6, define the threshold τ, when the sample When it is less than the threshold τ, it is marked as a normal sample; otherwise, When the threshold is exceeded, the sample is marked as an abnormal sample.

[0123] Furthermore, through this method, the samples in the original data set D are divided into a benign set B and a poisoned set P.

[0124] Furthermore, the specific steps of step S3 are as follows:

[0125] S3-1, construct the sample images finally generated by multiple rounds of iterations into a candidate set C(X i ,Y i ), select a sample in C that is similar to the original sample X i X with large difference j As X i After the cleansing, quantize X i and X j The process of distance between them is as follows:

[0126]

[0127] Among them, MSE is the mean square error, which quantifies the error by calculating the average of the square of the difference between the predicted value and the true value, and the cosine similarity Represents characteristics after causal intervention Cosine similarity in vector space.

[0128] Furthermore, cosine similarity quantifies X by the dot product of the feature vectors i and X j The similarity between , the definition process is as follows:

[0129]

[0130] S3-2, based on the metric in step S3-1, select from the candidate set C the sample that matches the original sample X i X with large difference j , thus obtaining the purified sample The process is represented as follows:

[0131]

[0132] From the above description, it can be seen that the beneficial effects of the present invention are: a causal diffusion model based on causal reasoning is proposed to purify the poisoned dataset, and the mechanism by which backdoor attack triggers and noise distribution as confounding factors induce false associations between poisoned images and predicted labels is discovered, revealing its backdoor path. Through experiments on three popular backdoor attacks, its significant effect in reducing the impact of backdoor attacks is demonstrated, while maintaining high prediction accuracy for benign samples.

[0133] The specific working principle of the present invention is described in detail below:

[0134] Please refer to Figure 1 , Embodiment 1 of the present invention is:

[0135] A backdoor defense method based on a causal diffusion model. This embodiment is a causal diffusion model for purifying a poisoned data set based on causal reasoning. The image is input into the diffusion model for multiple iterations of forward denoising and reverse denoising. In the reverse denoising process, residual calculation and causal layer are used to intervene in the backdoor path, and the true causal relationship between image features and labels is continuously updated. Finally, the generated images are extracted from each round to construct a candidate set. Then, according to the changes in the label probability distribution after each round of feature update of the recorded samples, the samples are divided into two categories: benign set and poisoned set. Finally, for these poisoned samples, considering the pixel and feature distance, the purified images are selected from their respective candidate sets to purify the data set.

[0136] like Figure 1 As shown, a backdoor defense method based on a causal diffusion model in this embodiment includes the following steps:

[0137] S1. Define a structural causal model, eliminate triggers through the causal diffusion model, and unmix the spurious associations between images and labels caused by the noise or distribution of the data itself in the reverse denoising process;

[0138] S2, using the diffusion model to generate the label prediction probability distribution of the image, after calculating the KL divergence, identify the poisoned samples by comparing with the threshold;

[0139] S3. For the identified poisoned samples, the dataset is purified by constructing a candidate set and selecting purified images from the candidate set considering pixel and feature distances.

[0140] That is, in this embodiment, the backdoor criterion based on causal intervention is applied to eliminate the false associations between the poisoned image and the predicted label caused by the backdoor attack trigger and the noise distribution as confounding factors, and reveal its backdoor path. The diffusion model is used to purify the sample, and the residual calculation and causal layer are used to intervene in the backdoor path in the reverse denoising process to eliminate the influence of false associations to achieve effective purification of the poisoned data set, thereby training a safe model without backdoors.

[0141] Please refer to Figure 2 , Embodiment 2 of the present invention is:

[0142] On the basis of the above-mentioned embodiment 1, a structural causal model is defined in step S1, triggers are eliminated through a causal diffusion model, and the causal intervention layer is used to unmix the false association between images and labels caused by the noise or distribution of the data itself in the reverse denoising process, which specifically includes the following steps:

[0143] S1-1, where B represents the trigger, X represents the image in the data set, Z represents the confounding factor (the noise or specific distribution of the data itself), M represents the feature of anomaly recognition, and Y represents the predicted label.

[0144] The defined structural causal graph has the following three paths:

[0145] B→Z→M→Y

[0146] B→X→M→Y

[0147] X→Y

[0148] S1-2, define the forward process q, starting from the original image x0, gradually adding Gaussian noise, and finally generating a noisy image x T The amount of noise added at each step is In x t-1 Generate image x under the condition T The process is the following formula:

[0149]

[0150] in, is the scaling factor, N is the symbol of the Gaussian distribution, The mean of the image generated by the Gaussian distribution at step t. t I represents the covariance matrix of the image generated in step t, represents the noise added in each step, and I is the unit matrix, indicating that the noise is isotropic. This step ensures the gradual blurring of the image in the forward process and eliminates the triggering features.

[0151] The overall probability distribution of the forward process is expressed as follows:

[0152]

[0153] S1-3, using the opposite process p θ To gradually restore the benign features (from x T Return to x0), and produce the purified image

[0154]

[0155] p θ (x t-1 |x t ):=N(x t-1 ;u θ (x t ,t),∑ θ (x t ,t))

[0156] Among them, the mean u θ (xt ,t) is learned by a parameterized neural network, the variance ∑ θ (x t ,t) can be a time step related constant or can be learned by a neural network, and N is the symbol of the Gaussian distribution.

[0157] S1-4, in each round of reverse denoising of the diffusion model, when the model estimates the current noise, the noise is removed from the current image feature Subtract it from the original image to get an updated feature representation that is closer to noise-free. The specific representation is as follows:

[0158]

[0159] S1-5. Using causal intervention to eliminate the influence of confounding factor Z, the formula for backdoor adjustment calculation of predicted label distribution is expressed as follows:

[0160]

[0161] in, Indicates that given the input image features Abnormal features t The conditional probability of label Y under the condition of and noise Z; P(z) represents the marginal distribution of noise z.

[0162] S1-6, Re-stated as a model The calculated Softmax output is:

[0163]

[0164] S1-7, the process of approximately calculating the expected value of S1-6 is expressed as:

[0165]

[0166] S1-8, E z Requires expensive sampling calculations. In order to simplify the calculation, the normalized weighted geometric mean (NWGM) is introduced to approximate the above expectation. In short, NWGM effectively transfers the external expectation to Softmax, and the process is expressed as:

[0167]

[0168] S1-9. Blocking backdoor paths gives X a fair chance to include each Z in the prediction of Y. f(~) is defined as follows:

[0169]

[0170] Among them, W1 and W2 are the parameter matrices of the model, is a constant scaling factor for feature normalization. At time step t, using the estimated m t Features Perform causal adjustments to generate adjusted features The process is expressed as:

[0171]

[0172] Among them, α is an adjustment coefficient used to control the intensity of causal intervention.

[0173] That is, in this embodiment, the backdoor criterion of causal intervention is applied to eliminate the false associations between the poisoned image and the predicted label caused by the backdoor attack trigger and the noise distribution as confounding factors, revealing its backdoor path.

[0174] Please refer to Figure 3 , Embodiment 3 of the present invention is:

[0175] Based on the above-mentioned embodiment 2, this embodiment uses the label prediction probability distribution of the image generated by the diffusion model, calculates the KL divergence, and identifies the poisoned samples by comparing with the threshold. And for the identified poisoned samples, by constructing a candidate set and considering the pixel and feature distance, the purified image is selected from the candidate set, thereby purifying the data set. Specifically, the following steps are included:

[0176] S2-1: For the label probability distribution in S1-5, select the image X0 generated by the last time step t=0 of the diffusion model for analysis, input the images generated by multiple rounds of iterations into the classifier model, and calculate the label probability distribution formula of the final generated image X0 as follows:

[0177] P(Y|X0)=Softmax(W*X0+b)

[0178] Among them, W and b are the weight and bias of the classifier, and P(Y|X0) represents the probability that image X0 belongs to each category.

[0179] S2-2, perform multiple rounds of independent reverse denoising processes on the same image, each time recording P(Y|X0) in step S2-1, and obtain P n (Y|X0), where n is the number of iterations.

[0180] S2-3. Take the average of the label probability distribution of n iterations of step S2-2 in this example, and obtain the formula of the average probability distribution as follows:

[0181]

[0182] S2-4. Use KL divergence to measure the difference between the label probability distribution of each iteration and the average probability distribution. The expression is as follows:

[0183]

[0184] Among them, C is the total number of label categories, Y i is the probability of the i-th class label.

[0185] S2-5, aggregate the differences of all iterations of step S2-4 in this example to obtain the aggregated difference amount The expression to be calculated is as follows:

[0186]

[0187] S2-6, define the threshold τ, when the sample When it is less than the threshold τ, it is marked as a normal sample; otherwise, When the threshold is exceeded, the sample is marked as an abnormal sample.

[0188] In this example, by using this method, the samples in the original data set D are divided into a benign set B and a poisoned set P.

[0189] In this embodiment, step S3 further includes:

[0190] The dataset is purified by constructing a candidate set and selecting purified images from the candidate set considering pixel and feature distances.

[0191] The specific steps are as follows:

[0192] S3-1, construct the sample images finally generated by multiple rounds of iterations into a candidate set C(X i ,Y i ), select a sample in C that is similar to the original sample X i X with large difference j As X i After the cleansing, quantize X i and X j The process of distance between them is as follows:

[0193]

[0194] Among them, MSE is the mean square error, which quantifies the error by calculating the average of the square of the difference between the predicted value and the true value, and the cosine similarity Represents characteristics after causal intervention Cosine similarity in vector space.

[0195] In this example, the cosine similarity is quantified by the dot product of the feature vector X iand X j The similarity between , the definition process is as follows:

[0196]

[0197] S3-2, based on the metric of step S3-1 in this example, select from the candidate set C the sample that is consistent with the original sample X i X with large difference j , thus obtaining the purified sample The process is represented as follows:

[0198]

[0199] That is, in this embodiment, the diffusion model is used to net poison samples, and the residual calculation and causal layer are used to intervene in the backdoor path in the reverse denoising process to eliminate the influence of false correlations to achieve effective purification of the poisoned data set, thereby training a safe model without backdoors.

[0200] In summary, the present invention has the following beneficial effects:

[0201] (1) From the perspective of poisoned data set purification: This paper re-examines the purification process of poisoned data from the perspective of causal graphs, and discovers the mechanism by which backdoor attack triggers and noise distribution as confounding factors induce false associations between poisoned images and predicted labels. By blocking the backdoor path, the confounding factors can be effectively removed, and poisoned samples can be converted into benign samples, thereby training a safe model without backdoors.

[0202] (2) From the perspective of method performance analysis: the method proposed in the present invention has a significant effect in reducing the impact of backdoor attacks on three popular backdoor attack experiments, while also maintaining a high prediction accuracy for benign samples.

[0203] The present invention also provides a backdoor defense system for purifying data sets based on a causal enhancement diffusion model, comprising a memory, a processor, and computer program instructions stored in the memory and capable of being executed by the processor. When the processor executes the computer program instructions, the method steps described above can be implemented.

[0204] The present invention also provides a computer-readable storage medium, on which computer program instructions that can be executed by a processor are stored. When the processor executes the computer program instructions, the method steps described above can be implemented.

[0205] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0206] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0207] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0209] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A backdoor defense method based on a causal diffusion model, characterized in that: include: S1. Define a structural causal model, eliminate triggers through the causal diffusion model, and unmix the spurious associations between images and labels caused by the noise or distribution of the data itself in the reverse denoising process; S2, using the causal diffusion model to generate the label prediction probability distribution of the image, after calculating the KL divergence, identify the poisoned samples by comparing with the threshold; S3. For the identified poisoned samples, the dataset is purified by constructing a candidate set and selecting purified images from the candidate set considering pixel and feature distances.

2. According to claim 1, a backdoor defense method based on a causal diffusion model is characterized in that: Step S1 includes the following steps: S1-1. Define the structural causal model and obtain the three paths of the structural causal graph as follows: B→Z→M→Y B→X→M→Y X→Y Among them, B represents the trigger, X represents the image in the data set, Z represents the confounding factor, that is, the noise or distribution of the data itself, M represents the feature of anomaly recognition, and Y represents the predicted label; S1-2, the forward process q starts from the original image x0 and gradually adds Gaussian noise to finally generate a noisy image x T ; S1-3. Use the process p opposite to the forward process q θ To gradually restore the benign characteristics, that is, from x T Return to x0 to produce the purified image S1-4. In each round of reverse denoising in the causal diffusion model, after the causal diffusion model estimates the current noise, the noise is removed from the current image feature Subtract it from the original image to get an updated feature representation that is closer to noise-free. The process is as follows: S1-5. Using causal intervention to eliminate the influence of confounding factor Z, the process of backdoor adjustment calculation and prediction label distribution is expressed as: in, Indicates that given the input image features Abnormal features t The conditional probability of label Y under the condition of and noise z; P(z) represents the marginal distribution of noise z; S1-6, Re-stated as a model The calculated Softmax output is: S1-7, the process of approximately calculating the expected value of S1-6 is expressed as: S1-8, E z Expensive sampling calculations are required. To simplify the calculations, the normalized weighted geometric mean NWGM is introduced to approximate the expectations of steps S1-7. The overall process is expressed as: S1-9, blocking the backdoor path gives X a fair chance to include each Z in the prediction of Y; f(~) is defined as follows: Among them, W1 and W2 are the parameter matrices of the model, is a constant scaling factor for feature normalization; at time step t, using the estimated m t Features Perform causal adjustments to generate adjusted features The overall process is expressed as: Among them, α is an adjustment coefficient used to control the intensity of causal intervention.

3. A backdoor defense method based on a causal diffusion model according to claim 2, characterized in that: In step S1-2, the amount of noise added in each step is In x t-1 Generate image x under the condition T The process is expressed as the following formula: in, is the scaling factor; N is the symbol of Gaussian distribution; The mean of the image generated by the Gaussian distribution at step t; β t I represents the covariance matrix of the image generated in step t, which represents the noise added in each step. I is the unit matrix, which means that the noise is isotropic. This step ensures the gradual blurring of the image in the forward process and eliminates the triggering features. The overall probability distribution of the forward process is as follows:

4. The backdoor defense method based on the causal diffusion model according to claim 2 is characterized in that: The overall process of step S1-3 is as follows: p θ (x t-1 |x t ):=N(x t-1 ;u θ (x t ,t),∑ θ (x t ,t)) Among them, the mean u θ (x t ,t) is learned by a parameterized neural network, the variance ∑ θ (x t , t) is a time step related constant or learned by the neural network, and N is the symbol of the Gaussian distribution.

5. The backdoor defense method based on the causal diffusion model according to claim 2 is characterized in that: Step S2 includes the following steps: S2-1, for the label probability distribution in step S1-5, select the image X0 generated at the last time step t=0 of the causal diffusion model for analysis, input the images generated by multiple rounds of iterations into the classifier model, and calculate the label probability distribution P(Y|X0) of the final generated image X0; S2-2, perform multiple rounds of independent reverse denoising processes on the same image, and record P(Y|X0) in step S2-1 each time to obtain P n (Y|X0), where n is the number of iterations; S2-3, taking the average of the label probability distribution of n iterations of step S2-2, the process of obtaining the average probability distribution is expressed as follows: S2-4. Use KL divergence to measure the difference between the label probability distribution and the average probability distribution of each iteration. The whole process is expressed as follows: Among them, C is the total number of label categories, Y i is the probability of the i-th label; S2-5, aggregate the differences of all iterations of step S2-4 to obtain the aggregated difference amount The overall process is shown as follows: S2-6, define the threshold τ, when the sample When it is less than the threshold τ, it is marked as a normal sample; otherwise, When the threshold τ is exceeded, the sample is marked as an abnormal sample, thereby dividing the samples in the original data set D into a benign set B and a poisoned set P.

6. A backdoor defense method based on a causal diffusion model according to claim 5, characterized in that: In step S2-1, P(Y|X0) is expressed as follows: P(Y|X0)=Softmax(W*X0+b) Among them, W and b are the weight and bias of the classifier, and P(Y|X0) represents the probability that image X0 belongs to each category.

7. The backdoor defense method based on the causal diffusion model according to claim 5 is characterized in that: Step S3 includes the following steps: S3-1, construct the sample images finally generated by multiple rounds of iterations into a candidate set C(X i ,Y i ), select a sample in C that is similar to the original sample X i X with large difference j As X i After the cleansing, quantize X i and X j The process of distance between them is as follows: Among them, MSE is the mean square error, which quantifies the error by calculating the average of the square of the difference between the predicted value and the true value, and the cosine similarity Represents characteristics after causal intervention Cosine similarity in vector space; S3-2, based on the metric in step S3-1, select from the candidate set C the sample that matches the original sample X i X with large difference j , and obtain the purified sample The overall process is shown as follows:

8. The backdoor defense method based on the causal diffusion model according to claim 7 is characterized in that: In step S3-1, cosine similarity Quantize X by the dot product of the eigenvectors i and X j The similarity between them is defined as follows:

9. A backdoor defense system based on a causal enhancement diffusion model to purify data sets, characterized in that: The method comprises a memory, a processor and computer program instructions stored in the memory and capable of being executed by the processor. When the processor executes the computer program instructions, the method steps as claimed in any one of claims 1 to 8 can be implemented.

10. A computer-readable storage medium having stored thereon computer program instructions that can be executed by a processor, and when the processor executes the computer program instructions, the method steps according to any one of claims 1 to 8 can be implemented.

Images