A redundant structural backdoor detection method, electronic device and storage medium based on branch activation statistical mechanism

Abstract

The present invention discloses a redundant structural backdoor detection method, electronic device and storage medium based on a branch activation statistical mechanism. By packaging the suspicious model with a branch channel function and using a dynamic counter to count the number of branch calls and activation ratios, the potential redundant backdoor branches in the model can be effectively identified. In the application scenario of a complex multi-branch network, regardless of whether the model is affected by structural poisoning, the present invention can accurately capture the activation behavior characteristics of each branch of the model and comprehensively evaluate the redundancy of the model. When a branch of a multi-branch neural network presents an extremely high activation frequency under specific input, and the activation contribution is significantly low under normal input, it is judged as a redundant branch of a backdoor attack for a specific task. The present invention can effectively reduce the potential threat of structural backdoor attacks to deep models, significantly improve the robustness and practical application value of the model, and provide a new technical means for the field of intelligent model security.

Description

Technical Field

[0001] The invention relates to a redundant structure backdoor detection method, electronic equipment and storage medium based on a branch activation statistical mechanism, and belongs to the technical field of computer malware detection. Background Art

[0002] With the continuous advancement of deep learning, the application of neural network models in tasks such as images, text and speech has achieved remarkable results. Traditional neural network models can achieve more refined predictions and judgments due to their complex network model structure and huge parameter volume. Although this has promoted the development of deep learning technology to a certain extent, with the rapid popularization of on-device AI and mobile smart devices, traditional large-scale deep learning models have limited their application on edge devices (such as smartphones, IoT devices, etc.) due to high computing resources and storage space requirements. It not only affects the overall response speed of the device, but also increases the energy consumption and resources of the device.

[0003] In order to make deep learning models more convenient to use in resource-constrained lightweight devices, researchers have gradually begun to focus on how to use efficient model compression technology to make complex models more lightweight, mainly including simplifying the model structure, streamlining parameters, and making the inference process more efficient. Commonly used model lightweight methods are mainly concentrated in the field of model compression, such as model pruning, quantization, low-rank decomposition and other methods to reduce model size and resource consumption. Although the above methods can achieve model compression to a certain extent, they still require a lot of resources on simplified mobile devices. In addition, existing studies have found that knowledge distillation, as a commonly used model compression method, can significantly reduce the number of parameters and improve efficiency by transferring the knowledge of the teacher model to the student model, and the student model imitates the output of the teacher model and learns its decision-making process. Because of its lightweight, the student model is more suitable for resource-constrained edge devices while maintaining high accuracy.

[0004] Although the knowledge distillation method has achieved remarkable results in tasks related to model lightweight compression, due to the flexibility and modifiability of the student model, it also exposes some security risks, especially structural backdoor attacks on model energy consumption. Illegal attackers may implant illegal backdoor branch channels during the compression training of the knowledge distillation model, disguising it as a multi-branch neural network model (such as BranchyNet and multi-export network) for structural poisoning. The poisoned backdoor model performs no differently from the clean model under benign input samples, but will make incorrect predictions or malicious performance consumption when encountering specific inputs with triggers, which not only wastes computing resources and causes security issues, but also increases the complexity of the network. This backdoor attack poses a huge threat in security-sensitive areas.

[0005] Existing backdoor defense and detection methods for deep model structures are mainly aimed at backdoor attacks based on image prediction labels. Defenders perform model defense by focusing on the input end (in the form of triggers) and the output end (the prediction results or loss functions of the model). For example, the patent document "Backdoor sample detection method, device and electronic device" (patent application number: 202010334289.6, application announcement number: CN 11291902 A) proposes a trigger detection defense method for backdoor samples. The patent document "An online backdoor sample detection method and system based on evolutionary bias" (patent application number: 202311003842.8, application publication number: CN 116739073 A) proposes an online backdoor sample detection method based on evolutionary bias, which provides a prerequisite for defending against image backdoor attacks. The backdoor defense method, image classification method and related equipment of the image classification model proposed in the patent document "Backdoor defense method of image classification model, image classification method and related equipment" (patent application number: 202411083247.4, application publication number: CN119251540 A) provides a prerequisite for backdoor defense in the field of image classification. Most of the above inventions are aimed at data poisoning and parameter poisoning, and backdoor defense and detection are performed by monitoring and detecting the input images, output labels, and neuron states of the neural network model; however, there are still loopholes in the defense and detection of backdoor attacks on multi-branch model redundant structures. Illegal backdoor attackers can embed redundant backdoor branches in the process of using knowledge distillation for model lightweight compression, and form malicious backdoor models through training, thereby realizing backdoor attacks. At the same time, since concealment measures and defensive means may be added during the training process, the victim cannot defend only through input and output detection means, which poses a huge threat to the security and application of deep learning models (especially the widespread application on resource-constrained devices). Summary of the invention

[0006] Purpose: In order to overcome the deficiencies in the prior art, the present invention provides a redundant structural backdoor detection method, electronic device and storage medium based on a branch activation statistics mechanism.

[0007] Technical solution: To solve the above technical problems, the technical solution adopted by the present invention is:

[0008] In the first aspect, a redundant structural backdoor detection method based on a branch activation statistics mechanism specifically includes:

[0009] The structure of the model to be detected is analyzed to obtain the model calculation graph of the model to be detected. By parsing the model calculation graph, the multi-branch channels in the model to be detected are identified.

[0010] The multi-branch channels in the packaged to-be-detected model are transformed to form a packaged branch channel function, and the packaged branch channel function constitutes the packaged to-be-detected model.

[0011] The packaged model to be tested is tested, and the packaged branch channel function is used to obtain the comprehensive activation frequency and branch activation condition entropy of each branch channel.

[0012] The activation contribution ratio and redundancy prediction score of each branch channel are calculated based on the comprehensive activation frequency of each branch channel and the conditional entropy of branch activation.

[0013] According to the activation contribution ratio and redundancy prediction score of each branch channel, it is determined whether the branch channel of the model to be tested is a redundant branch or a potential backdoor branch.

[0014] As a preferred solution, the method further includes: the model to be detected is also verified by the complete data set after preprocessing, and the model to be detected that has passed the verification is selected for structural analysis.

[0015] As a preferred solution, the packaged branch channel function The expression is as follows:

[0016]

[0017] in, Represents the input data of the branch channel. Represents a dynamic counter, To give, If the branch channel is activated, the counter Increment by 1.

[0018] As a preferred solution, the comprehensive activation frequency of each branch channel The expression is as follows:

[0019]

[0020] in, , For input sample Whether to activate the branch The indicator variable, , .

[0021] Branch activation conditional entropy for each branch channel The expression is as follows:

[0022]

[0023] in, For input sample Whether to activate the branch The indicator variable, , , is the comprehensive activation frequency of each branch channel.

[0024] As a preferred solution, the activation contribution ratio of each branch channel is The expression is as follows:

[0025] ;

[0026] in, is the comprehensive activation frequency of each branch channel, is the total activation frequency;

[0027] ;

[0028] Alternatively, the activation contribution of each branch channel is The expression is as follows:

[0029] ;

[0030] in, Is a non-zero positive number.

[0031] As a preferred solution, the redundancy prediction score of each branch channel is The expression is as follows:

[0032]

[0033] in, For branch channel The branch activation condition entropy of For branch channel The branch activation condition entropy of For branch channel The comprehensive activation frequency, For branch channel The comprehensive activation frequency, To find the maximum value function, Represents weight.

[0034] As a preferred solution, according to the activation contribution ratio and redundancy prediction score of each branch channel, it is determined whether the branch channel of the model to be tested is a redundant branch or a potential backdoor branch, specifically including:

[0035] If the branch channel The redundancy prediction score of And activation contribution ratio , then the branch channel It is a redundant branch or a potential backdoor branch.

[0036] If the branch channel The redundancy prediction score of And activation contribution ratio , then the branch channel It is the core branch of normal reasoning.

[0037] in, Represents the model redundancy judgment score threshold, Represents the branch activation contribution ratio threshold.

[0038] As a preferred option, , .

[0039] In a second aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements a redundant structural backdoor detection method based on a branch activation statistics mechanism as described in any one of the first aspects.

[0040] According to a third aspect, a computer device includes:

[0041] Memory, used to store instructions.

[0042] The processor is used to execute the instructions so that the computer device performs the operations of the redundant structural backdoor detection method based on the branch activation statistics mechanism as described in any one of the first aspects.

[0043] Beneficial effects: The present invention provides a redundant structural backdoor detection method, electronic device and storage medium based on a branch activation statistics mechanism. The method packages the suspicious model with a branch channel function and uses a dynamic counter to count the number of branch calls and activation ratios, thereby effectively identifying potential redundant backdoor branches in the model. In the application scenario of complex multi-branch networks, regardless of whether the model is affected by structural poisoning, this method can accurately capture the activation behavior characteristics of each branch of the model and comprehensively evaluate the redundancy of the model. When a branch of a multi-branch neural network exhibits an extremely high activation frequency under specific input, and its activation contribution is significantly low under normal input, it is judged as a redundant branch for backdoor attacks on specific tasks. Through this method, the potential threat of structural backdoor attacks to deep models can be effectively reduced, the robustness and practical application value of the model can be significantly improved, and a new technical means is provided for the field of intelligent model security. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of a redundant structural backdoor detection method based on branch activation statistics mechanism.

[0045] Figure 2 The implementation framework diagram of the redundancy detection method is shown in FIG.

[0046] Figure 3 Schematic diagram of redundancy detection of Resnet18-BA model. DETAILED DESCRIPTION

[0047] The following is a clear and complete description of the technical solutions in the examples of the present invention in conjunction with the accompanying drawings in the examples of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the protection scope of the present invention.

[0048] The present invention will be further described below in conjunction with specific embodiments.

[0049] Embodiment 1:

[0050] This embodiment introduces a redundant structural backdoor detection method based on a branch activation statistics mechanism. Figure 1 As shown, it includes: data preprocessing and preparation of the model to be tested, structural analysis of the model to be tested, branch channel function packaging, model reasoning branch activation monitoring, channel branch activation frequency analysis, and model redundancy prediction results. Specifically, it includes the following steps:

[0051] Step 1: Data preprocessing and preparation of the model to be tested: Extract the data from the open source dataset categories, The original data composition of Zhang Zitu A data set of categories; for the i-th sub-graph in the data set The characteristic matrix Perform normalized data preprocessing to form indivual The standard characteristic matrix of , ensuring that it meets the standardized requirements for the input of the model to be tested. By using the standard Python framework, load the trained and saved model to be tested ,in, Represents the model to be tested that is saved after the training phase. Contains the model structure and parameters or The loaded model to be tested can be restored to its state during training and evaluation, thus achieving an efficient inference process.

[0052] Furthermore, the step 1 specifically includes:

[0053] Preprocess the open source dataset according to the model to be tested The standard input size requirement is, for example, the input size of ResNet18 is 224×224×3, for the i-th sub-graph Make size adjustments , ensuring that its size meets the input requirements of the model to be tested; at the same time, for each resized sub-image , First, grayscale processing is performed to extract pixel values ​​as pixel features; then the gradient amplitude and direction of each pixel are obtained as gradient features by calculating the gradient (Sobel operator), and the pixel features and gradient features are spliced ​​column by column to form a unified feature matrix . For the feature matrix Normalize it to meet the standardization conditions: ,in, and Represent the feature matrix After normalization, the matrix The value of each element of will be within the range of zero mean and unit variance, and the normalized subgraph will be obtained , Subgraph The standard characteristic matrix of Corresponding to a label category as the preprocessed data set, the complete data set after preprocessing correspond The preprocessed dataset can improve the inference accuracy and stability of the model.

[0054] Load the model to be tested that was trained and saved using a standard deep learning framework , or format file, using the complete preprocessed dataset Verify the model to be tested The availability of , ensures that it can effectively carry out the inference process. The model to be tested is loaded using the loading function provided by Pytorch: ,in is the saved model file path, This is the complete model after loading. The model loaded in this way can retain all the weights and parameters learned during the training process, ensuring high efficiency and accuracy during the inference or evaluation phase.

[0055] Step 2: Structural analysis of the model to be tested: using Model to be tested Analyze the structure of Model calculation graph. Among them, It is a core component of PyTorch JIT (Just-in-time compilation), which means obtaining the model calculation graph, which is used to describe the model calculation path and process, and identify the model to be tested through the model calculation graph Multi-branch channels in; Get branch channels And the topological connection relationship between different branch channels, get the dependency matrix , through the dependency matrix The input and output dimensions of each branch and the position of each branch in the reasoning path are obtained, providing a basic basis for subsequent dynamic analysis and redundant branch detection.

[0056] Furthermore, the step 2 specifically includes:

[0057] use Get the model to be tested Model calculation diagram , Represents a collection of nodes. Represents the edge set, calculates the graph G through the parsing model, and identifies the model to be tested The multi-branch channel in . The multi-branch channel refers to the part of the computation path with parallel computation, which is usually manifested as multiple independent sub-paths (such as branches in residual networks).

[0058] Assume the model to be tested Depend on The branch channels consist of: ,in, Indicates the first The input sample set of the model to be tested is , the output is In actual operation, input data The model to be tested will be activated according to specific conditions Some branch sets of , Model to be tested The final output can be expressed as follows:

[0059] y j = f M ( x j ) = ∑ i = 1 n I [ x j ∈ A j ] ⋅ B i ( x j )

[0060] in, I [ ∗ ] is an indicator function, indicating whether the input sample activates the Branches , Represents input data After The processing result of the branch channel is Represents input data After the model to be tested The processing result.

[0061] In addition, in order to quantify the dependencies between branches, a dependency matrix is ​​introduced ,in, Indicates branch channel Whether to rely on branch channels . This matrix can be obtained by analyzing the model calculation graph:

[0062] R i , j = I [ B i of lose enter Bag Contains B j of lose out ] ,

[0063] The construction of the dependency matrix helps clarify the computational logic relationship between branches. Depends on but ,otherwise , providing a basis for subsequent analysis.

[0064] In addition, according to the dependency matrix Topological sorting of The set of pre-associated dependency paths :

[0065]

[0066] in, If ,Right now Depends on ;like When activated, you can know has been activated, then all Together The set of dependent paths and . Path Collection Identified branch channel The input sources and information flow paths.

[0067] Step 3: Branch channel function packaging: Use packaging function interceptors, such as hook functions, to transform and package branch channels. , forming the branch channel function after packaging , monitor each branch channel , and get the branch channel Number of activations and activation indicator variables Among them, the wrapper function interceptor is used to intercept the input and output of each call to the branch channel, record the activation status of the branch channel in real time, and provide detailed data support for subsequent branch monitoring and frequency statistics.

[0068] Furthermore, the step 3 specifically includes:

[0069] After completing the model to be tested After structural analysis, each branch channel needs to be The core idea of ​​branch channel function packaging is to introduce dynamic counters through hook functions. , flexibly capture the model to be detected The number of calls and input characteristics of each branch channel.

[0070] Packaged branch channel function The definition is as follows:

[0071]

[0072] in, Represents the input data of the branch channel. Represents a dynamic counter, To give, If the branch channel is activated, the counter Increment by 1.

[0073] By treating the detection model Each branch channel The package can track the activation status of the branch channel in real time. Define the activation indicator variable: For input sample Whether to activate the branch Indicator variable:

[0074]

[0075] in, Indicates input samples, .

[0076] Through the wrapped branch channel function , using dynamic counter Record statistics branch channel Number of activations The sum of :

[0077]

[0078] Is the test data set in the model to be tested Branch channel The total number of activations.

[0079] Therefore, the packaged model to be tested The output in the forward propagation can be expressed as:

[0080]

[0081] During training or inference, when a branch channel When activated, the corresponding dynamic counter The activation behavior is automatically increased by 1. This mechanism provides raw data for subsequent activation frequency analysis and redundancy prediction.

[0082] Step 4: Model inference branch activation monitoring: During the inference detection process, use Preprocessed data The standard characteristic matrix of After packaging, the model to be tested Test using the wrapped branch channel function For each branch module The call activation status of the branch channel is monitored batch by batch, and the number of calls of the branch channel is recorded by using a dynamic counter in each reasoning operation. and multi-branch distribution , If the input sample Whether to activate the branch , if activated , to capture the significant differences in branch channel behaviors among different test samples.

[0083] Furthermore, the step 4 specifically includes:

[0084] Model to be tested Redundancy reasoning detection phase, dynamically monitoring each branch channel The activation of , can accurately record samples Is the branch activated? :

[0085] a k , i = I [ x k ∈ X ∩ B i ∗ ( x k ) ]

[0086] in: Is an indicator function, indicating whether the condition is met. If the activation conditions are met, ,otherwise .

[0087] In addition, the model to be tested In the process, multiple branches are usually activated together, so the dynamic correlation between different branch channels needs to be considered. Also with the dependency path from step 2 In order to comprehensively evaluate the various branch channels of the model The activation behavior of The formula is further expanded:

[0088]

[0089] Is a collection, indicating the dependent branch channel The associated sub-branch Activation status . It is a logical OR function, using binary 0, 1 to convert the activation state set of the sub-branch into the branch The activation state after transformation The dynamic coupling between branches can be determined, which can better adapt to complex multi-branch network models.

[0090] For the entire training set , the comprehensive activation probability of branch channel activation It can be defined as:

[0091]

[0092] in, , indicating that all samples In all branch channels The total number of activations.

[0093] In addition, in order to further quantify the influence of sample input on branch activation, the branch activation condition entropy is introduced , used to measure the uncertainty of multi-branch activation:

[0094]

[0095] The branch activation condition entropy can be used to evaluate whether the activation pattern of the branch is stable. A higher entropy value may mean that the behavior of the branch is more affected by external factors.

[0096] Step 5: Channel branch activation frequency analysis: Based on the data recorded in step 4, analyze the activation frequency of each branch channel. The comprehensive activation frequency and activation contribution ratio are counted and calculated. By formula The total activation frequency is By activating the contribution ratio Calculation can analyze the activation contribution ratio of each branch channel of the model By comparing, it is possible to identify redundant branch channels in the case of normal input samples.

[0097] In order to more accurately analyze the redundant backdoor branch channels of the model, we will Modified to be based on the branch activation condition entropy value and the integrated activation frequency Comprehensive indicators:

[0098]

[0099] is a parameter that takes a small positive number to avoid the denominator being zero.

[0100] It can be concluded that When it is close to 1, it means that the branch activation is stable and frequent, indicating that the branch may be a core branch; When it is close to 0, it means that the branch activation is random or the activation frequency is low, which may be a redundant branch. At the same time, the branch activation stability judgment based on the entropy value of the branch activation condition is also introduced. , evaluate the stability of model branches.

[0101] Step 6, model redundancy prediction results: comprehensive activation frequency , branch activation condition entropy , construct the model redundancy prediction score:

[0102] ,

[0103] in, Indicates that for channel branches The branch activation condition entropy of It means to find the maximum value of conditional entropy in all branch channels. represents the weight, Indicates branch channel The comprehensive activation probability of Represents the maximum value of the comprehensive activation probability of all branch channels.

[0104] Reflects the stability of the branch. If the entropy is high, the value of this item is high, indicating that the branch activation behavior is random. Reflects low usage of the branch. If the activation frequency is low, the value of this item is high. Control the relative importance of two factors.

[0105] Jordi Branches The redundancy prediction score of And activation contribution ratio , Represents the model redundancy judgment score threshold, It indicates the branch activation contribution ratio threshold. , When the model comprehensively determines the redundant backdoor detection effect, it is the best) and it is a redundant branch or a potential backdoor branch. Branches The redundancy prediction score of And activation contribution ratio , it means that it is the core branch of normal reasoning of the model.

[0106] Embodiment 2:

[0107] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a redundant structural backdoor detection method based on a branch activation statistics mechanism as described in any one of Embodiment 1.

[0108] Embodiment 3:

[0109] A computer device comprising:

[0110] Memory, used to store instructions.

[0111] The processor is used to execute the instructions so that the computer device performs the operations of a redundant structural backdoor detection method based on a branch activation statistics mechanism as described in any one of Embodiment 1.

[0112] Embodiment 4:

[0113] The clean model Resnet18 and the energy consumption backdoor attack model Resnet18-BA (BA, Backdoor Attack) are used as examples of neural network models for detection. The dataset uses the Tiny-ImageNet open source dataset. Tiny-ImageNet is a small image dataset widely used in image classification tasks. It contains 200 categories, each of which contains 500 training images, 50 verification images, and 150 test images. It can effectively reflect the performance of the model when processing image data with certain complexity and transformation. The model to be detected is recorded as .

[0114] like Figure 2 As shown in FIG. 1 , the implementation process of the redundant structural backdoor detection method based on the branch activation statistical mechanism includes the following steps:

[0115] The first step is data preprocessing and preparation of the model to be tested: preprocess the open source dataset Tiny-ImageNet and The standard input size requirement (224×224×3) is adjusted ; At the same time, for each sub-graph The characteristic matrix Normalize , the feature matrix The value of each element of will be within the range of zero mean and unit variance, and the preprocessed input image will be obtained. .

[0116] Using the model loading function provided by Pytorch: Load the structure and parameters of the model to be tested, or Format file, where is the saved model file path, It is the complete model after loading, which verifies whether the model can predict labels normally based on the input content to ensure the availability of the model.

[0117] The second step is to analyze the structure of the model to be tested: Model to be tested After structural analysis, we can get Resnet18-BA: In order to further quantify the dependencies between branches, the analytical dependency matrix is ​​introduced through the computational graph : R i , j = I [ B i of lose enter Bag Contains B j of lose out ] , further branching Predetermined dependency path .

[0118] The third step is branch channel function packaging: We use the hook function to wrap each branch. The channel function is packaged and a dynamic counter is introduced Get the branch channel function , in order to dynamically monitor the activation behavior of the branch. If the input sample activation ,but , dynamic counter Increase by 1, and finally get the branch channel Total activations .

[0119] Step 4: Model inference branch activation monitoring: using preprocessed input data After packaging, the model to be tested By activating the indicator variable and the dependency path of step 2 Comprehensive monitoring and logging branch The activation status of the Calculate the comprehensive activation probability of branch channel activation corresponding to the data set and branch activation condition entropy Measures the activity and stability of branch channels.

[0120] Step 5: Channel branch activation frequency analysis: Based on the data monitored and recorded in step 4, the comprehensive activation frequency can be obtained. , calculate the total activation frequency , thereby analyzing the activation contribution ratio of each branch , considering the impact of activation stability on prediction, the branch activation condition entropy and the integrated activation frequency Comprehensive consideration to get the activation contribution ratio .

[0121] when When it is close to 1: it means that the activation of the branch is mainly triggered by normal data, which means that the behavior of the branch is normal and has actual contribution; when Much less than 1 (close to 0): This indicates that the branch is mainly activated by triggers or special input conditions and may be a redundant branch or a backdoor branch.

[0122] Step 6. Model redundancy prediction results: comprehensive activation frequency and branch activation condition entropy , construct the redundant prediction score of the model . Redundancy prediction score and activation contribution ratio Comprehensively determine the model redundancy test results. and :The redundancy prediction score of the model branch indicates that the branch activation is unstable or has a low frequency, and is a redundant branch or a backdoor branch. and : The branch activation is stable and frequent, and it is a core normal branch.

[0123] Combination Figure 3 Model redundancy detection, Resnet18 (residual network 18), Resnet18-BA (residual network 18-Backdoor Attack), Mobilenet (lightweight neural network) were experimentally verified on the datasets Cifar10 (Canadian Institute for Advanced Research-10), Tiny-ImageNet (a small version of the ImageNet dataset), and Fashion-MNIST (an image dataset that replaces the classic MNIST dataset). The results are shown in Table 1. It can be found that the Resnet18-BA model Activation contribution ratio of branches And the redundancy prediction score Therefore, it can be concluded that the Resnet18-BA model is a structurally redundant backdoor model, while the activation contributions of the branches of the Mobilenet and Resnet18 models are relatively high and the redundancy prediction scores show low indicators, which can be judged as clean and normal models.

[0124] Table 1 Redundant branch detection

[0125]

[0126] The present invention follows the above steps through a complete process from structural analysis to behavior monitoring to redundancy quantification, which can accurately identify and locate redundant branch channels of structural backdoor attacks and provide guidance for model optimization. In this process, by real-time monitoring of the activation state of each branch and combining the analysis of activation frequency, redundant branches that show low activation under normal input but abnormal activation under specific triggers are identified, thereby accurately locating the potential source of backdoor attacks. In addition, combined with redundancy prediction, the negative impact of redundant branches on model performance is further evaluated and weakened, which improves the robustness and defense capabilities of the model in the face of complex attacks, and ensures the safety, reliability and efficiency of the model in practical applications. This method combines complex formulas with dynamic analysis technology and is an innovative solution for the security of multi-branch neural networks.

[0127] According to the structural characteristics of the multi-branch neural network model, this paper proposes a redundant structural backdoor detection method based on the branch activation statistical mechanism. This method uses the branch call counting formula and the universal wrapper function as a carrier to achieve accurate monitoring and statistics of the model branch call frequency and activation conditions under dynamic trigger conditions. The detection results can effectively identify the redundant branches and potential backdoor channels that may exist in the model, thereby improving the computing resource utilization, transparency and security of the model.

[0128] Using the above steps, this method can comprehensively analyze the model structure and identify potential backdoor redundant branches through dynamic monitoring and data analysis, significantly improving the model's security and resource utilization efficiency. Through the combination of data preprocessing, model structure analysis, and dynamic monitoring of branch behavior, accurate analysis of branch activation frequency and contribution can be achieved, providing a strong basis for model optimization and redundancy detection. This method not only improves the reliability and operating efficiency of the model in practical applications, but also provides an innovative solution for the investigation of security risks in model deployment and maintenance.

[0129] The present invention is a redundant structural backdoor detection method based on a branch activation statistical mechanism, which can accurately identify potential poisoned redundant structural branches in the model, and provide a quantitative basis for model optimization through the analysis of activation frequency and contribution. This method can significantly improve its detection capability of structural poisoned redundant backdoor attacks without affecting the original reasoning performance of the model, thereby reducing the risk of abnormal behavior caused by backdoor attacks on the model, and ensuring the reliability and security of the model in real application scenarios. Compared with the existing neural network structure backdoor attack detection method, the present invention fills the gap in the branch redundancy analysis of the existing neural network structure backdoor attack detection method, provides a new technical means for the safe deployment of deep learning models, and has important theoretical value and practical application significance.

[0130] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A redundant structural backdoor detection method based on branch activation statistics mechanism, characterized by: Specifically include: Analyze the structure of the model to be detected to obtain the model calculation graph of the model to be detected, and identify the multi-branch channels in the model to be detected by parsing the model calculation graph; Transforming the multi-branch channels in the packaged to-be-detected model to form a packaged branch channel function, and the packaged branch channel function constitutes the packaged to-be-detected model; Test the packaged model to be tested, and use the packaged branch channel function to obtain the comprehensive activation frequency and branch activation condition entropy of each branch channel; The activation contribution ratio and redundancy prediction score of each branch channel are calculated according to the comprehensive activation frequency of each branch channel and the branch activation conditional entropy; According to the activation contribution ratio and redundancy prediction score of each branch channel, determine whether the branch channel of the model to be tested is a redundant branch or a potential backdoor branch; The activation contribution ratio R of each branch channel i The expression is as follows: Among them, P i is the comprehensive activation frequency of each branch channel, P total is the total activation frequency; Alternatively, the activation contribution ratio of each branch channel is R i The expression is as follows: Among them, ε is a non-zero positive number; The redundancy prediction score E of each branch channel i The expression is as follows: Among them, H(B i |X) is branch channel B i The branch activation condition entropy, H(B j |X) is branch channel B j The branch activation condition entropy, P i Branch channel B i The comprehensive activation frequency, P j Branch channel B j The comprehensive activation frequency, max is the maximum value function, and λ represents the weight; According to the activation contribution ratio and redundancy prediction score of each branch channel, it is determined whether the branch channel of the model to be tested is a redundant branch or a potential backdoor branch, including: If branch channel B i The redundant prediction score E i >T and activation contribution ratio R′ i <Q, then branch channel B i It is a redundant branch or a potential backdoor branch; If branch channel B i The redundant prediction score E i <T and activation contribution ratio R′ i >Q, then branch channel B i It is the core branch of normal reasoning; Among them, T represents the model redundancy judgment score threshold, and Q represents the branch activation contribution ratio threshold.

2. According to claim 1, a redundant structural backdoor detection method based on branch activation statistics mechanism is characterized in that: Also includes: The model to be tested is also verified by the complete data set after preprocessing, and the model to be tested that passes the verification is selected for structural analysis.

3. A redundant structural backdoor detection method based on branch activation statistics mechanism according to claim 1 or 2, characterized in that: The packaged branch channel function B i * The expression is as follows: Where x represents the input data of the branch channel; C i represents a dynamic counter, ← represents assignment, B i * (x) indicates that if branch channel B i (x) is activated, then the counter C i Increment by 1.

4. A redundant structural backdoor detection method based on branch activation statistics mechanism according to claim 1 or 2, characterized in that: The comprehensive activation frequency P of each branch channel i The expression is as follows: in, a k,i For the input sample x k Whether to activate branch B i indicator variable, k = 1, 2, ..., m, i = 1, 2, ..., n; The branch activation conditional entropy H(B) of each branch channel i |X) is expressed as follows: Among them, a k,i For the input sample x k Whether to activate branch B i indicator variable, k=1,2,…,m, i=1,2,…,n, P i is the comprehensive activation frequency of each branch channel.

5. The redundant structural backdoor detection method based on branch activation statistics mechanism according to claim 1 is characterized in that: T=0.6, Q=0.

5.

6. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it is characterized in that: Implement a redundant structural backdoor detection method based on a branch activation statistics mechanism as described in any one of claims 1 to 5.

7. A computer device, characterized in that: include: A memory for storing instructions; The processor is used to execute the instructions so that the computer device performs the operations of the redundant structural backdoor detection method based on the branch activation statistics mechanism as described in any one of claims 1 to 5.

Images