A robust backdoor defense method and system without auxiliary data dependence

Abstract

The present invention discloses a robust backdoor defense method and system without auxiliary data dependence, which belongs to the field of deep learning model security and artificial intelligence defense technology. The present invention analyzes the intrinsic relationship between backdoor injection and sample contamination through counter-perturbation, and preliminarily isolates clean samples and contaminated samples from the poisoned data set; reverse learning and re-learning are performed on the selected clean samples to train an enhanced poisoning model; the enhanced poisoning model is used to accurately identify contaminated samples and clean samples, and the model is trained based on the clean samples to finally obtain a robust model without backdoors. Finally, the contaminated samples are re-labeled and used for fine-tuning the robust model without backdoors, further improving the robustness of the model. The present invention does not rely on any auxiliary clean data set, and can effectively resist multiple backdoor attacks while maintaining the high accuracy of the model. The present invention fills the gap in the prior art for training robust backdoor defense models without auxiliary data.

Description

Technical Field

[0001] The present invention relates to the field of deep learning model security and artificial intelligence defense technology, and in particular to a robust backdoor defense method and system without auxiliary data dependence. Background Art

[0002] In recent years, with the widespread application of deep learning technology, the scale and complexity of deep learning models have continued to increase. These models have achieved remarkable breakthroughs in numerous fields, including computer vision, natural language processing, and speech recognition. However, as model performance improves, the security and reliability of deep learning models have become increasingly prominent. In particular, their reliance on large amounts of data for training often requires the use of external data sources, which are not always trustworthy and are susceptible to data contamination and malicious attacks.

[0003] A backdoor attack is a typical attack method. The attacker introduces specific triggers into the training data, causing the model to output specific erroneous results when processing inputs with these triggers, while the model behaves normally with other normal inputs. This covert attack method makes backdoor attacks difficult to detect, especially when the data source is uncontrollable, greatly increasing the risk of backdoor attacks.

[0004] Many research works have proposed methods for detecting and defending against backdoor attacks, but most of these methods rely on supplementary clean datasets. This means that when performing backdoor defense on toxic datasets, additional clean data is often required for model validation and testing. However, in practical applications, obtaining sufficient clean datasets is often infeasible, especially in large-scale datasets. In this case, ensuring the security of models on toxic datasets without supplementary clean data has become an important issue that needs to be addressed.

[0005] Existing backdoor attack defense methods mainly include the following categories:

[0006] 1. Data cleaning methods: Preprocess the dataset based on statistical analysis or heuristic algorithms to remove samples that may contain backdoor triggers. These methods often require additional clean datasets to help identify anomalous samples.

[0007] 2. Model repair methods: By repairing the model for specific input patterns in the later stages of model training, the model's sensitivity to backdoor triggers is reduced. However, this method also requires the use of a clean dataset for repair verification, and the defense effect is often not stable.

[0008] 3. Adversarial training methods: By introducing adversarial examples into the training model, the model's robustness to the input data is enhanced, thereby reducing the success rate of backdoor attacks. However, the effectiveness of such methods in practical applications often depends on the quality and diversity of the training data.

[0009] Therefore, a limitation of existing defense methods is that they often rely on additional clean datasets to improve their effectiveness. However, in many practical scenarios, obtaining large-scale clean datasets is not feasible. Therefore, effectively defending against backdoor attacks without auxiliary data has become a major challenge in the field of deep learning model security. Summary of the Invention

[0010] Aiming at the lack of effective defense against backdoor attacks in existing research without auxiliary data, the present invention proposes a robust backdoor defense method and system without auxiliary data reliance.

[0011] The technical solutions proposed by the present invention are as follows:

[0012] In a first aspect, the present invention proposes a robust backdoor defense method without auxiliary data dependence, comprising the following steps:

[0013] (1) Obtain a toxic dataset with potential backdoor contamination and initialize a deep learning model; the toxic dataset is an image dataset, including contaminated samples and clean samples, the contaminated samples are labeled as attack target categories, and the clean samples are labeled as true categories; the deep learning model takes the image as input and outputs the predicted category of the image;

[0014] (2) Through adversarial perturbation analysis, the initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic dataset, and the contaminated sample set and the clean sample set are preliminarily divided;

[0015] (3) Based on the initially divided contaminated sample set and clean sample set, relearning and reverse learning of the poisoning model are performed to train an enhanced poisoning model, and the contaminated sample set and clean sample set are continuously updated during the training process; the poisoning model is obtained by training a deep learning model with the poisoned data set;

[0016] (4) By enhancing the poisoning model, clean samples are identified from the polluted sample set updated in step (3) and merged with the clean sample set updated in step (3), the polluted sample set and the clean sample set are continuously updated, and the backdoor-free robust model is trained using the updated clean sample set;

[0017] (5) Use the robust model without backdoors to re-label the contaminated sample set obtained by step (4), and merge the re-labeled samples with the clean sample set obtained by step (4) to form the final clean sample set. Use the final clean sample set to fine-tune the robust model without backdoors to complete the training of the robust backdoor defense model.

[0018] Furthermore, step (2) includes:

[0019] (2-1) Generate a random perturbation δ and a perturbation mask m for each sample in the poisonous dataset;

[0020] (2-2) Apply perturbation δ and perturbation mask m to each sample x of the toxic dataset to obtain the perturbed sample

[0021]

[0022] (2-3) Calculate the original sample x and the perturbed sample The KL divergence between them is used to screen clean samples and contaminated samples according to the size of the KL divergence value, and the toxic dataset is preliminarily divided into contaminated sample set and clean sample set.

[0023] Furthermore, the random disturbance is calculated by the following formula:

[0024]

[0025] Among them, l(f θ (x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the disturbance, is the perturbation gradient, ‖.‖2 is the L2 norm.

[0026] Furthermore, in step (2-3), a KL divergence threshold is set. When the KL divergence of a sample is greater than the threshold, the sample is judged to be a clean sample; otherwise, the sample is judged to be a potentially contaminated sample.

[0027] Furthermore, step (3) includes:

[0028] (3-1) Relearning the poisoned model using the contaminated sample set, identifying clean samples from the contaminated sample set using the relearned poisoned model, updating the contaminated sample set and the clean sample set, and performing reverse learning on the relearned poisoned model based on the updated clean sample set;

[0029] (3-2) Repeat the process of step (3-1) using the contaminated sample set and the clean sample set updated in step (3-1). After the number of iterations is met, the enhanced poisoning model is obtained.

[0030] Furthermore, the goal of the relearning is to minimize the loss function of the contaminated samples, and the goal of the reverse learning is to maximize the loss function of the clean samples.

[0031] Furthermore, the relearned poisoning model is used to identify clean samples from the contaminated sample set, and the contaminated sample set and the clean sample set are updated, specifically:

[0032] Through adversarial perturbation analysis, the KL divergence between each sample in the contaminated sample set before and after perturbation is calculated. According to the size of the KL divergence value and the segmentation rate, clean samples are screened out from the current contaminated sample set, and new contaminated sample sets and clean sample sets are updated.

[0033] Furthermore, the formula for the split ratio is as follows:

[0034] p=1-(e+1)×γ

[0035] Where p is the segmentation rate, e is a mathematical constant, and γ is a parameter used to control the segmentation threshold.

[0036] Furthermore, the step (4) is specifically as follows:

[0037] (4-1) Traverse each sample in the contaminated sample set updated in step (3), identify the samples whose output categories of the enhanced poisoning model are inconsistent with the sample labels as clean samples, and merge them with the clean sample set updated in step (3) to obtain a new contaminated sample set and a clean sample set;

[0038] (4-2) Use the new clean sample set obtained in step (4-1) to train the deep learning model initialized in step (1). The training goal is to minimize the loss function of the clean samples and obtain a robust model without backdoors.

[0039] In a second aspect, the present invention proposes a robust backdoor defense system without auxiliary data dependence, which is used to implement the above-mentioned robust backdoor defense method.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] (1) The present invention can effectively identify contaminated samples and clean samples from a toxic dataset without an auxiliary clean dataset, and then generate a robust model without backdoors.

[0042] (2) The present invention improves the robustness of the model and enhances the model's defense capability against backdoor attacks by combining counter-perturbation analysis with relearning and reverse learning techniques.

[0043] (3) During the iterative training process, the present invention achieves progressively optimized robust defense model training by accurately distinguishing contaminated samples from clean samples, thereby reducing the impact of backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The following is an architectural diagram of a robust backdoor defense system without auxiliary data dependency.

[0045] Figure 2 Flowchart for preliminary screening of datasets through adversarial perturbations;

[0046] Figure 3 Flowchart of relearning and reverse learning based on poisoning model;

[0047] Figure 4 Flowchart of a robust backdoor defense method without auxiliary data dependence;

[0048] Figure 5 ASR and ACC of ResNet18 based on the enhanced poisoning model. DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be noted that the following examples are intended to facilitate understanding of the present invention and do not have any limiting effect on the present invention.

[0050] In one embodiment provided by the present invention, Figure 1 The following diagram shows the architecture of the robust backdoor defense system based on poisoned datasets without relying on auxiliary data. It is mainly divided into five modules: data preprocessing and analysis module based on adversarial perturbations, relearning and reverse learning module based on poisoned models, sample precision classification module, backdoor-free robust model training module, and relabeling and dataset merging module. The following describes these five modules separately:

[0051] 1. Data preprocessing and analysis module based on adversarial disturbance

[0052] This module primarily processes tainted datasets potentially contaminated with backdoors. Its goal is to identify and initially distinguish between clean and potentially contaminated samples within these datasets through a series of preprocessing steps and adversarial perturbation analysis techniques. This module operates by systematically analyzing the responses of deep learning models to malicious perturbations, revealing anomalous behavior in potentially contaminated samples. In many backdoor attacks, attackers inject malicious information into the model's training process by injecting specific triggers, causing the model to perform well on normal inputs but produce incorrect predictions under specific trigger-induced input conditions. The attacker's goal is to make these contaminated samples difficult to detect, resulting in a small difference in model output between contaminated and normal samples. To address this challenge, the adversarial perturbation-based data preprocessing and analysis module introduces adversarial perturbations to force more significant changes in the model's output. Adversarial perturbations are small but targeted input perturbations that maximize the model's prediction uncertainty, revealing the different performance of contaminated and clean samples in the model. Specifically, the system generates a random perturbation for each sample and evaluates it based on the KL divergence between the perturbed model output and the original output. This difference can reflect the stability of the sample in the face of disturbances and further distinguish potential contaminated samples from clean samples. The preprocessing and analysis steps of this module can not only effectively identify potential contaminated samples, but also lay the foundation for subsequent model relearning and reverse learning. By analyzing the response of the sample in the face of disturbances, the system can gradually filter out the clean sample set to further improve the robustness of the model. Figure 2 As shown, the working mechanism of this module includes the following steps:

[0053] (1) First, the system obtains a poisonous dataset D from an external data source. The dataset contains contaminated samples and clean samples. The samples in the poisonous dataset D are image samples, where the labels of the contaminated samples are the attack target category labels, and the labels of the clean samples are the true category labels. Initialize the deep learning model f θ , parameter θ is the weight of the model. The model has not been fully trained, and subsequent steps are needed to improve the model's ability to distinguish between contaminated samples and clean samples.

[0054] (2) To further analyze the contamination level of the sample, the system generates a random perturbation δ and a perturbation mask m for each sample x in the toxic dataset D. The perturbation δ is used to apply a small amount of perturbation to the sample x, and the mask m is used to control the area of ​​the perturbation. In one embodiment of the present invention, the formula for generating the perturbation is:

[0055]

[0056] Among them, l(f θ(x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the disturbance, which is used to control the intensity of the disturbance. is the perturbation gradient.

[0057] Apply the perturbation δ and mask m to the sample x to generate the perturbed sample The calculation formula is as follows:

[0058]

[0059] here, is the perturbed sample, and m is a mask used to control the application area of ​​the perturbation.

[0060] (3) In order to distinguish the contaminated samples from the clean samples in the toxic dataset D, the system compares the original output and the perturbed output of each sample and calculates the KL divergence (Kullback-Leibler Divergence) between the two. The calculation formula of KL divergence is as follows:

[0061]

[0062] Among them, f θ (x) and are the outputs of the original sample and the perturbed sample respectively, and i is the sample category index. By calculating the KL divergence of the sample, we can determine whether the sample is contaminated: Assume N b is the number of clean samples in the dataset D, N p is the number of contaminated samples in the dataset D, each sample is independently and identically sampled from a uniform distribution and belongs to K categories, the deep neural network f θ is a multivariate kernel regression model (RBF kernel) with the same goal as the attacker, and for a given attacked sample x′=(1-m)⊙x+m⊙t, t is the trigger implanted by the attacker. There is: when N p Approximation N b hour, The above shows that when D p When the size is close to that of the clean sample, the contaminated sample is robust to potential disturbances. Therefore, when the KL divergence is small, it indicates that the sample output remains stable after the disturbance is added, and it is more likely to be a contaminated sample; when the KL divergence is large, it indicates that the sample output changes significantly after the disturbance, and it is more likely to be a clean sample.

[0063] (4) According to the KL divergence of each sample, the system divides the samples in the poisoned dataset D into two categories: clean sample set D c and contaminated sample set D p In this embodiment, the KL divergence threshold is set. When it is greater than the threshold, the sample x is judged to be a clean sample, otherwise it is a potential contaminated sample; the potential contaminated sample means that the sample has a high probability of being a contaminated sample.

[0064] 2. Relearning and reverse learning modules based on poisoning models

[0065] The main purpose of this module is to strengthen the backdoor effect of the poisoned model on the contaminated sample set, generate an enhanced poisoned model, and gradually screen out possible clean samples, merge them into the clean sample set, and use these clean samples for reverse learning to weaken the poisoned model's dependence on the backdoor trigger. Through the process of relearning and reverse learning, the poisoned model gradually enhances its ability to distinguish contaminated samples and reduces its sensitivity to backdoor triggers. Figure 3 As shown, the working mechanism of this module includes the following steps:

[0066] (1) First, we use the contaminated sample set D that has been identified through adversarial perturbation analysis. p , for the poisoning model Perform intensive training, the poisoning model is trained by the poisonous data set D to train the deep learning model f θ The obtained one has the properties of high ASR (Attack Success Rate) and low ACC (Accuracy). In this embodiment, taking ResNet18 as an example, Figure 5 The ASR and ACC of ResNet18 based on the enhanced poisoning model are displayed, which has the properties of high ASR and low ACC.

[0067] During the reinforcement training process, the system strengthens the poisoned model's learning of the backdoor triggers in the contaminated samples, thereby constructing an enhanced poisoned model. Reinforcement training is a process of relearning, which is achieved by minimizing the loss function of the contaminated samples:

[0068]

[0069] Among them, D p represents the contaminated sample set, represents the loss function of the poisoning model, It is a poisoning model.

[0070] (2) During the intensive training process, the system observes the output performance of the model on different samples and uses these performances to further screen out possible clean samples: the contaminated sample set D is evaluated by the poisoning model. p Among the samples, select the samples that are closer to the normal samples (that is, the clean samples that may be mistakenly marked as potential contaminated samples); merge these screened samples into the clean sample set D c , and prepare the clean sample set Dc Conduct reverse learning;

[0071] In this embodiment, the segmentation formula for screening clean samples is:

[0072] p=1-(e+1)×γ

[0073]

[0074] Among them, D c Represents the clean sample set, e is a mathematical constant, p is the segmentation rate, and γ is a parameter used to control the threshold in the segmentation process. Indicates the use of poisoning model According to the segmentation rate p, from the current contaminated sample set D p Filter out clean samples and update to get a new contaminated sample set D p and clean sample set D c . Splitting according to the splitting rate p means: splitting the current contaminated sample set D p Sample input poisoning model in Calculate the KL divergence of each sample and sort them from large to small, and remove the top-ranked samples from the current contaminated sample set D according to the split rate p p Remove and include in the clean sample set D c In the subsequent iterations, more and more clean samples will be selected for subsequent reverse learning, and in the contaminated sample set D with increasing poisoning rate p Strengthen the training of poisoning model.

[0075] (3) The purpose of reverse learning is to maximize the loss function of clean samples by weakening the learning effect of the poisoned model on clean samples, so that the poisoned model gradually reduces its dependence on backdoor triggers. Specifically, the goal of reverse learning is to maximize the loss function of clean samples. This process can be achieved by adjusting the poisoning model parameter θ:

[0076]

[0077] Through reverse learning, the system weakens the poisoned model's dependence on the backdoor trigger while ensuring that the poisoned model's ability to identify contaminated samples remains unchanged.

[0078] (4) In order to ensure the robustness of the model, the relearning and reverse learning processes can be repeated multiple times, that is, repeating the above steps (1) to (3), evaluating the performance of the poisoned model after each iteration, and adjusting the parameters of the poisoned model based on the performance. Specifically, it includes: relearning iteration, after each round of iteration, recalculating the loss of the poisoned model on the contaminated samples and clean samples, and further adjusting the parameters of the poisoned model based on these loss results, so that the poisoned model can better distinguish between clean samples and contaminated samples; reverse learning iteration, during the reverse learning process, as the clean sample set gradually expands, the system will continuously update the poisoned model so that its loss on the clean samples gradually decreases.

[0079] Through multiple iterations of training and optimization, the system finally built an enhanced poisoning model The model maintains efficient learning capabilities on contaminated samples and accurately identifies backdoor triggers. Furthermore, through a reverse learning process, the model performs poorly on clean samples, enabling better differentiation between clean and contaminated samples. This enhanced poisoning model provides the foundation for subsequent accurate identification of contaminated samples.

[0080] 3. Sample Accurate Classification Module

[0081] The main goal of this module is to use the trained enhanced poisoning model to further refine the distinction between contaminated samples and clean samples in the existing contaminated sample set and clean sample set. After processing by this module, the system generates a final clean sample set D c This sample set will be used to train a robust model without backdoors. This process ensures that the model achieves higher accuracy in distinguishing contaminated samples from clean samples through precise classification criteria:

[0082] (1) Enhanced poisoning model obtained through multiple iterative training and reverse learning Re-evaluate all samples and further accurately distinguish between contaminated and clean samples based on the model's performance on clean and contaminated sample sets;

[0083] Specifically, traverse the contaminated sample set D p , input the sample into the enhanced poisoning model If the model If the output category is inconsistent with the sample label, the sample will be merged into the original clean dataset D c , thus forming the final clean dataset D c , which is expressed as follows:

[0084]

[0085] 4. Backdoor-free robust model training module

[0086] This module aims to use the final generated clean sample set D c , train a robust model f without backdoor θ .

[0087] In the clean sample set D generated by the "sample accurate classification module" c Based on this, the system starts to train the deep learning model f used in the data preprocessing and analysis module based on adversarial perturbations θ , a robust model without backdoor is obtained; the learning process is achieved by minimizing the loss function l(f θ (x), y) to achieve:

[0088]

[0089] Through multiple rounds of iterative training, the model parameters θ are gradually optimized to make the robust model f without backdoors θ It can show good classification performance on clean sample sets.

[0090] 5. Re-labeling and dataset merging module

[0091] The main task of this module is to use the robust model f without backdoor θ For the contaminated sample set D after the above steps p The re-labeled samples are then merged with the previously confirmed clean sample set to form a more comprehensive and clean dataset. By using this complete clean dataset to train the robust model f without backdoors θ After fine-tuning training, the robustness of the model is further improved. In subsequent use, the model can resist various backdoor attacks and maintain good performance.

[0092] (1) In order to obtain a complete clean dataset and further improve the performance of the clean model, we can also utilize potential selected contaminated samples by relabeling the contaminated samples and merging them with the clean samples to obtain a clean and complete dataset D′:

[0093]

[0094] (2) Use the complete dataset D′ to fine-tune the robust model f without backdoors θ , to further improve its performance, and finally obtain a robust backdoor defense model, which can resist various backdoor attacks and maintain good performance in subsequent use.

[0095] The above describes the functions and implementation details of each module. The system embodiment composed of each module can be applied to any device with data processing capabilities, such as a computer or other device. The system embodiment can be implemented through software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by the processor of any device with data processing capabilities reading the corresponding computer program instructions from the non-volatile memory into the internal memory and executing them.

[0096] Combining the functions of the above modules, the process of implementing a robust backdoor defense method based on poisonous data sets without auxiliary data dependence is as follows: Figure 4 As shown, it mainly includes the following steps:

[0097] S1, obtains a poisonous dataset from an external data source and initializes a deep learning model. The poisonous dataset is an image dataset, and some images in the dataset are contaminated, that is, the labels of some images are not the real categories, but the attack target categories set by the attacker.

[0098] S2, using the initialization model to identify potential contaminated samples and clean samples in the toxic data set, and obtain the potential contaminated sample set and the clean sample set;

[0099] S3, re-learn the poisoned model through the contaminated sample set, use the re-learned poisoned model to update the contaminated sample set and clean sample set, and reversely learn the poisoned model through the updated clean sample set. This process can be iterated several times to obtain an enhanced poisoned model;

[0100] S4, by enhancing the poisoning model, accurately distinguishes contaminated samples from clean samples in the updated contaminated sample set, merges the distinguished clean samples with the updated clean sample set, and uses the clean sample set to train a robust model without backdoors;

[0101] S5, use the robust model without backdoors to re-label the samples in the contaminated sample set and merge them with the clean sample set to form a complete clean data set. Use the complete clean data set to fine-tune the robust model without backdoors to enhance the robustness of the model, and finally obtain a robust backdoor defense model.

[0102] The following experiments demonstrate the technical effects of the present invention.

[0103] Table 1 lists the eight backdoor attack methods used in the experiment, including five state-of-the-art backdoor attacks and three state-of-the-art adaptive attacks.

[0104] Table 1 The eight most advanced backdoor attack methods

[0105]

[0106]

[0107] First, let’s introduce the various attributes in Table 1:

[0108] Poisoning ratio: refers to the ratio of training data used for modification in backdoor attacks to the total data. The poisoning ratio of all methods in Table 1 is 0.05.

[0109] Trigger: A mark or pattern inserted by the attacker into the image to activate the backdoor behavior. Triggers vary between attack methods, such as a white square, a Hello Kitty image, or a sinusoidal signal.

[0110] Static / Dynamic: Indicates whether the trigger is fixed (static) or deforms or changes in the input image (dynamic).

[0111] Clean / polluted: refers to whether the attack dataset has been modified or polluted. The polluted dataset has the attack trigger inserted.

[0112] Adaptive: Indicates whether the attack is adaptive; some attack methods can adapt to the input (yes), while others cannot (no).

[0113] Source: The source attack indicates whether there is a clear attack source. Some of the methods in Table 1 do not involve source attacks.

[0114] Target: refers to the target of the attack, usually 1, indicating that the target classification has been successfully attacked.

[0115] Coverage: Indicates the proportion of the input covered by the trigger.

[0116] Here are 8 of the most advanced backdoor attack methods:

[0117] BadNet is a classic backdoor attack method. During training, the attacker inserts a 3×3 white square into a portion of the training data as a trigger and associates this tampered data with a specified target category. This trigger is static, meaning its position and shape in the image remain unchanged. Because BadNet tampered with the data (dirty), it is a contamination-type backdoor attack. The goal of BadNet is to cause the model to incorrectly classify the input as the specified target category when the trigger appears in the test data.

[0118] The Blend attack uses a Hello Kitty image with a transparency of 0.2 as a trigger, poisoning the image by "blending" it into the training data. Similar to BadNet, it is also a static, contamination attack method, meaning that the trigger is fixed and unchanged in all modified samples. This trigger not only changes some features of the input image but also retains some of the original information. Similar to BadNet, when this trigger is detected during the testing phase, the model will incorrectly classify the image as the target category specified by the attacker.

[0119] SIG (Sinusoidal Signal) is a backdoor attack whose trigger uses a sinusoidal signal, which is implemented by modulating the color intensity of the input image. Unlike other attacks, SIG is a clean attack, meaning the data itself has not been visibly tampered with, and the visual effect of its trigger is relatively weak. This attack can conceal its backdoor behavior without affecting the visual visibility of the image. SIG attacks are also static, meaning that each tampered data contains the same sinusoidal signal as a trigger.

[0120] WaNet is a dynamic backdoor attack whose trigger is implemented through image deformation. Unlike static triggers, WaNet embeds the trigger within the geometric deformation of the image, making its trigger dynamic. This approach is unique in that it does not rely on obvious external visual elements, but instead hides the trigger through complex geometric distortions. During testing, the model is misled into misclassifying inputs containing geometric deformations. Although WaNet's attack strategy is relatively stealthy, it is still a contamination attack.

[0121] PhysicalBA (Physical Backdoor Attack) is a physical backdoor attack whose trigger is the Firefox browser icon. Unlike other attacks, this attack is usually used in physical scenarios, such as physical objects in images or videos. This means that an attacker can activate the backdoor attack by showing a specific trigger in a real-world scenario (such as a printed Firefox icon). This method uses a static trigger, and the attack goal is similar to other backdoor attacks: when the trigger appears, the model will incorrectly classify the input.

[0122] TaCT (Targeted Clean-Label Trigger) is an improved backdoor attack method. Similar to BadNet, it uses a 3×3 white square as a trigger. However, the difference is that TaCT is adaptive, meaning that it can adjust certain characteristics of the trigger based on different inputs. TaCT is specifically designed as a passive (Source=0) attack, which means that its attack targets only take effect on specific categories and not on all inputs. In addition, TaCT adjusts the coverage during the attack to improve the stealth of the attack, with a coverage of 0.01.

[0123] AdaptiveBlend is an adaptive version of the Blend attack. It also uses a Hello Kitty image as a trigger, but unlike Blend, it is adaptive, meaning the attack can adjust the specific characteristics of the trigger based on different inputs. The AdaptiveBlend attack maintains the basic principles of the Blend method, but due to its adaptive nature, the trigger may exhibit different blending levels or positions on different samples, making it more flexible and difficult to detect in practice. Its coverage is also relatively small, reaching 0.01.

[0124] AdaptivePatch is an improved version of PhysicalBA that uses four Firefox icons as triggers. The key difference between AdaptivePatch and PhysicalBA is its adaptability, allowing it to adjust its triggers based on varying input data. This attack method typically performs better in physical scenarios. For example, during testing, an attacker can activate the backdoor by displaying these icons in real-world objects. Furthermore, AdaptivePatch has a low coverage of approximately 0.01, making its triggers difficult to detect.

[0125] Table 2 lists the defense effects of eight defense methods (including the present invention) under five non-adaptive backdoor attack modes, among which AdvrBD is the present invention;

[0126] Table 2: The effectiveness of eight defense methods against five non-adaptive backdoor attack methods

[0127]

[0128]

[0129]

[0130] Here are 7 defense methods other than this invention:

[0131] Fine-tuning is a method of further training a pre-trained model. Typically, it uses clean data to update some of the model's parameters, thereby weakening or eliminating the effectiveness of backdoor attacks. The goal of fine-tuning is to maintain the model's classification performance (ACC) while reducing the attack success rate (ASR). However, the effectiveness of fine-tuning depends on the model's structure and the type of attack, and may not always be completely effective.

[0132] FinePruning is a defense method that eliminates backdoors by pruning unimportant neurons from the model. Specifically, it first uses clean training data to identify neurons that are sensitive to backdoor triggers and then prunes these neurons. This effectively reduces the success rate of backdoor attacks (ASR) while minimizing the model's classification performance (ACC). This method has the advantage of not requiring modifications to the model architecture.

[0133] CutMix is ​​a data augmentation technique designed to enhance model robustness by combining image portions from different samples during training. This method randomly cuts a portion of a training image and splices it with a portion of another image to form a new training sample. This allows the model to better respond to triggers presented in the input, thereby reducing the success rate of backdoor attacks. In this way, CutMix makes it more difficult for the model to learn the patterns of backdoor triggers, thereby reducing the success rate of attacks (ASR).

[0134] Clean Label Pruning (CLP) is a clean label pruning defense method based on the fact that backdoor attacks typically only affect specific neurons. CLP prunes and fine-tunes the model to remove neurons that are highly sensitive to backdoor attacks without affecting the model's performance on normal inputs. This method can significantly reduce the attack success rate (ASR), but may have a certain impact on the model's classification accuracy (ACC).

[0135] DBR (Defense against Backdoor with Regularization) defends against backdoor attacks by introducing a regularization term. This approach assumes that backdoor attacks affect specific neurons or pathways in the model and applies regularization to constrain the model's parameters to prevent these neurons or pathways from becoming overly sensitive to triggers. The goal of DBR is to reduce the attack success rate while maintaining the model's classification performance.

[0136] SCANFT (Subspace Clean Anomaly-Free Training) is a defense strategy based on cleanup and anomaly detection. It detects and removes potential backdoor triggers by analyzing anomalous behavior in the model's feature space. Specifically, SCANFT uses feature analysis during training to identify anomalous model performance on attack samples, thereby reducing the success rate of attacks. This approach can theoretically detect discrepancies between triggers and normal inputs, effectively mitigating backdoor attacks.

[0137] Adversarial-based Backdoor Learning (ABL) defends against backdoor attacks using an adversarial learning approach. By introducing adversarial examples, ABL forces the model to learn more robust features during adversarial training, thereby resisting the influence of backdoor triggers. By using adversarial examples during training, ABL effectively reduces the model's sensitivity to backdoor triggers and reduces the success rate of attacks. The advantage of ABL is that it improves defenses against backdoor attacks without significantly reducing the model's classification performance (ACC).

[0138] Table 3 lists the defense effects of eight defense methods (including the present invention) under three adaptive backdoor attack modes, among which AdvrBD is the present invention;

[0139] Table 3. Defensive effects of eight defense methods against five non-adaptive backdoor attack methods.

[0140]

[0141]

[0142]

[0143] Table 4 shows the improvement in defense effectiveness against backdoor attacks using the re-labeling and re-learning methods.

[0144] Table 4. Defense effect of ResNet18 against backdoor attacks after using re-labeling and re-learning methods

[0145]

[0146] Table 4 shows the performance of ResNet18 trained on the full CIFAR10 dataset using the relabeling and relearning method. It can be seen that after training on the relabeling and relearning dataset, the average model performance (ACC) changes from 84.29% to 86.65% and the attack success rate (ASR) changes from 0.33% to 0.03% in the face of 8 state-of-the-art backdoor attacks.

[0147] The above examples are merely specific embodiments of the present invention. Obviously, the present invention is not limited to the above examples, and many variations are possible. All variations that can be directly derived or imagined by a person skilled in the art from the disclosure of the present invention should be considered to be within the scope of protection of the present invention.

Claims

1. A robust backdoor defense method without auxiliary data dependence, characterized in that: The following steps are involved: (1) Obtain a toxic dataset with potential backdoor contamination and initialize a deep learning model; the toxic dataset is an image dataset, including contaminated samples and clean samples, the contaminated samples are labeled as attack target categories, and the clean samples are labeled as true categories; The deep learning model takes an image as input and outputs a predicted category of the image; (2) Through adversarial perturbation analysis, the initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic dataset, and the contaminated sample set and the clean sample set are preliminarily divided; (3) Based on the initially divided contaminated sample set and clean sample set, relearning and reverse learning of the poisoning model are performed to train an enhanced poisoning model, and the contaminated sample set and clean sample set are continuously updated during the training process; the poisoning model is obtained by training a deep learning model with the poisoned data set; (4) By enhancing the poisoning model, clean samples are identified from the polluted sample set updated in step (3) and merged with the clean sample set updated in step (3), the polluted sample set and the clean sample set are continuously updated, and the backdoor-free robust model is trained using the updated clean sample set; (5) Use the robust model without backdoors to re-label the contaminated sample set obtained by step (4), and merge the re-labeled samples with the clean sample set obtained by step (4) to form the final clean sample set. Use the final clean sample set to fine-tune the robust model without backdoors to complete the training of the robust backdoor defense model.

2. The robust backdoor defense method without auxiliary data dependence according to claim 1, characterized in that: Step (2) includes: (2-1) Generate a random perturbation δ and a perturbation mask m for each sample in the poisonous dataset; (2-2) Apply perturbation δ and perturbation mask m to each sample x of the toxic dataset to obtain the perturbed sample (2-3) Calculate the original sample x and the perturbed sample The KL divergence between them is used to screen clean samples and contaminated samples according to the size of the KL divergence value, and the toxic dataset is preliminarily divided into contaminated sample set and clean sample set.

3. The robust backdoor defense method without auxiliary data dependence according to claim 2, characterized in that: The random perturbation is calculated by the following formula: Among them, l(f θ (x), y) represents the loss function of the model, f θ (x) is the output of the model, y is the label of the sample, ∈ is the maximum amplitude of the disturbance, is the perturbation gradient, ‖.‖2 is the L2 norm.

4. The robust backdoor defense method without auxiliary data dependence according to claim 2, characterized in that: In step (2-3), a KL divergence threshold is set. When the KL divergence of a sample is greater than the threshold, the sample is judged to be a clean sample; otherwise, the sample is judged to be a potentially contaminated sample.

5. The robust backdoor defense method without auxiliary data dependence according to claim 1, characterized in that: Step (3) includes: (3-1) Relearning the poisoned model using the contaminated sample set, identifying clean samples from the contaminated sample set using the relearned poisoned model, updating the contaminated sample set and the clean sample set, and performing reverse learning on the relearned poisoned model based on the updated clean sample set; (3-2) Repeat the process of step (3-1) using the contaminated sample set and the clean sample set updated in step (3-1). After the number of iterations is met, the enhanced poisoning model is obtained.

6. The robust backdoor defense method without auxiliary data dependence according to claim 5, characterized in that: The goal of the relearning is to minimize the loss function of the contaminated samples, and the goal of the reverse learning is to maximize the loss function of the clean samples.

7. The robust backdoor defense method without auxiliary data dependence according to claim 5, characterized in that: The method of using the relearned poisoning model to identify clean samples from the contaminated sample set and updating the contaminated sample set and the clean sample set is as follows: Through adversarial perturbation analysis, the KL divergence between each sample in the contaminated sample set before and after perturbation is calculated. According to the size of the KL divergence value and the segmentation rate, clean samples are screened out from the current contaminated sample set, and new contaminated sample sets and clean sample sets are updated.

8. The robust backdoor defense method without auxiliary data dependence according to claim 7, characterized in that: The formula for the split ratio is as follows: p=1-(e+1)×γ Where p is the segmentation rate, e is a mathematical constant, and γ is a parameter used to control the segmentation threshold.

9. The robust backdoor defense method without auxiliary data dependency according to claim 1, characterized in that: The step (4) is specifically as follows: (4-1) Traverse each sample in the contaminated sample set updated in step (3), identify the samples whose output categories of the enhanced poisoning model are inconsistent with the sample labels as clean samples, and merge them with the clean sample set updated in step (3) to obtain a new contaminated sample set and a clean sample set; (4-2) Use the new clean sample set obtained in step (4-1) to train the deep learning model initialized in step (1). The training goal is to minimize the loss function of the clean samples and obtain a robust model without backdoors.

10. A robust backdoor defense system without auxiliary data dependence, characterized in that: include: A data preprocessing and analysis module based on adversarial perturbation is used to obtain a toxic dataset with potential backdoor contamination and generate adversarial perturbations on samples in the toxic dataset. Through adversarial perturbation analysis, an initialized deep learning model is used to identify potential contaminated samples and clean samples in the toxic dataset, and preliminarily divide the contaminated sample set into a clean sample set. The toxic dataset is an image dataset containing contaminated samples and clean samples. The contaminated samples are labeled with the attack target category, and the clean samples are labeled with the true category. The deep learning model takes an image as input and outputs a predicted category of the image; A relearning and reverse learning module based on the poisoned model is used to relearn and reversely learn the poisoned model based on the initially divided contaminated sample set and clean sample set, train an enhanced poisoned model, and continuously update the contaminated sample set and clean sample set during the training process; the poisoned model is obtained by training a deep learning model with a poisoned dataset; A sample precision classification module is used to identify clean samples from the contaminated sample set updated by the relearning and reverse learning modules based on the poisoning model by enhancing the poisoning model and merge them with the clean sample set updated by the relearning and reverse learning modules based on the poisoning model, so as to further update the contaminated sample set and the clean sample set; A backdoor-free robust model training module, which uses the clean sample set updated by the sample precision classification module to train the deep learning model used in the adversarial perturbation-based data preprocessing and analysis module to generate a backdoor-free robust model; The re-labeling and dataset merging module is used to use the backdoor-free robust model to re-label the samples in the contaminated sample set updated by the sample precision classification module, and merge the re-labeled samples with the clean sample set updated by the sample precision classification module to form the final clean sample set, which is used to fine-tune the backdoor-free robust model and complete the training of the robust backdoor defense model.

Images