Multi-backdoor fusion poisoning attack method based on spatial frequency domain conversion
Through the multi-backdoor fusion poisoning attack method based on spatial frequency domain conversion, triggers are generated and fused to activate multiple backdoors, which solves the problem of poor multi-target backdoor attack in the existing technology, improves the attack success rate and provides important research value for multi-backdoor defense.
Patent Information
- Application Number
- CN202411881786.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art is difficult to effectively carry out multi-target backdoor attacks, and the multi-backdoor defense method is not effective when facing multiple backdoors.
Using a multi-backdoor fusion poisoning attack method based on spatial frequency domain transformation, triggers are generated through proxy models and fused to activate multiple backdoors to form a model with multiple backdoors.
Increases the success rate of multi-target backdoor attacks and provides important research value and attack threats in the event that existing defense methods cannot completely remove all backdoors.
Smart Images
Figure CN119652637A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence security, and in particular to a poisoning attack method based on multi-backdoor fusion based on space-frequency domain conversion. Background Art
[0002] With the rapid development and widespread application of artificial intelligence (AI) technology, AI security has become an important research field. AI models are widely used in fields such as medicine, finance, and autonomous driving. However, recent research results show that machine learning models are extremely vulnerable to various malicious attacks. Attackers embed malicious samples in training data. These samples contain specific features or patterns, i.e., triggers, and are associated with incorrect labels. When the model learns these samples during training, they become part of the model's decision-making process. When the model encounters inputs containing these specific features, it will produce incorrect or predetermined outputs, while performing normally in other cases. As a typical attack method that affects the security model of deep neural networks (DNNs), backdoor attacks have attracted widespread attention from academia and industry. At present, most backdoor attack methods can only rely on a single target, and there are fewer multi-target attack techniques, which limits the application of multi-target attacks in specific scenarios. In addition, multi-target attacks are more flexible and can ensure the continuity of attacks to a certain extent. However, if there are too many backdoors in the model, it will have a negative impact on the success rate of targeted attacks.
[0003] Backdoor attacks are divided into dirty label attacks and clean label attacks according to the different ways they are formed. Dirty label attacks aim to force the model to remember the association between the backdoor trigger and the target class. Although dirty label attacks are effective, they have a serious weakness: the injected data instances are obviously mislabeled, which can be easily detected if the training data set is manually inspected. As research deepens, in order to increase the concealment of the backdoor, attackers have proposed clean label attacks, in which such triggers are only applied to the target class. However, since these poisoned inputs come from the target class and already contain some significant natural features that indicate the class, the learning model tends to associate natural features rather than backdoor triggers with the target class. Clean label attacks only require adding patches without modifying labels, which increases the difficulty of manual verification.
[0004] At the same time, backdoor defense has gradually received attention. The current backdoor defense methods can already defend against most single triggers, that is, single backdoors. However, for the defense against multiple backdoors, even if most research can resist one backdoor, the remaining backdoors can still play a role. Summary of the invention
[0005] In view of the deficiencies in the prior art, the present invention provides a poisoning attack method based on multi-backdoor fusion of space-frequency domain conversion. The attack method has a high success rate and provides important research value for multi-backdoor defense.
[0006] The technical solution adopted by the present invention to solve the above problem is: a poisoning attack method based on multi-backdoor fusion of space-frequency domain conversion, comprising the following steps:
[0007] Step 1: Proxy model preparation;
[0008] Generate a model with good prediction rate for the original data set provided by the victim as a proxy model; Step 2: trigger generation;
[0009] After obtaining the proxy model, the attacker extracts the target class data to be attacked from the original data set, fuses the target class data with randomly initialized noise, then puts the data into the proxy model for training, and uses the small batch stochastic gradient descent method to generate triggers;
[0010] Step 3: Trigger injection;
[0011] After obtaining the trigger, the target class data is fused with the trigger of the target class; then the fused data set is added to the remaining clean data in the original data set to form a complete poisoned data set, and finally the poisoned data set is trained. When the poisoned data set converges, a model with multiple backdoors will be obtained;
[0012] Step 4: Model attack;
[0013] Prepare multiple triggers to trigger the corresponding backdoors, fuse these triggers to obtain a single fused trigger for activating multiple backdoors; use the fused trigger to attack the final model with backdoors.
[0014] The agent model of the present invention Generated by the following formula:
[0015]
[0016] in is the final trained proxy model, θ * is the optimal parameter of the surrogate model, x i and i It is the annotation of the original dataset.
[0017] In step 2 of the present invention, for a certain target class 1, its trigger is generated by the following formula:
[0018]
[0019] in In order to finally obtain a trigger with good relevance to target class 1; It is the data of target class 1; is the loss function; is the proxy model; δ1 is the initialization noise.
[0020] In step 4 of the present invention, the specific fusion steps are as follows:
[0021] (1) Convert the trigger obtained in step 2 from the spatial domain to the frequency domain;
[0022] (2) then fusing the converted multiple triggers;
[0023] (3) Subsequently, the fused triggers in the frequency domain are converted back to the spatial domain.
[0024] In the fusion step (1) of the present invention, the trigger is converted from the spatial domain to the frequency domain using the Floyd fast transition.
[0025] The formula for conversion of the present invention is as follows:
[0026]
[0027] where δ / is the trigger obtained by converting the original trigger δ from the spatial domain to the frequency domain, (u, v) is the coordinate corresponding to the trigger in the frequency domain; the double summation symbol indicates the accumulation of all spatial points of the two-dimensional signal, ranging from x = 0 to M-1, and from y = 0 to N-1, that is, the summation is performed on each pixel of the signal matrix; M and N are the length and width of the trigger; δ(x, y) is the two-dimensional discrete signal value in the spatial domain, corresponding to the pixel value of the image or other two-dimensional data at the position (x, y); is the complex exponential factor.
[0028] In the fusion step (2) of the present invention, a soft fusion method is used, and the formula is as follows:
[0029]
[0030] Where λ is the trigger fusion hyperparameter.
[0031] In the fusion step (3) of the present invention, the conversion formula is as follows:
[0032]
[0033] in is the optimal fusion trigger obtained, (x, y) is the coordinate domain of the trigger in space; M and N are the length and width of the trigger; is a factor used for normalization; the double summation symbol indicates the accumulation operation of all points in the frequency domain, ranging from u = 0 to M-1, and from v = 0 to N-1; Represents the value of the frequency domain signal, corresponding to the frequency component of the frequency coordinate (u, v); is a complex exponential term.
[0034] Compared with the prior art, the present invention has the following advantages and effects: it integrates multiple triggers to achieve a multi-target clean label backdoor poisoning attack, and the victim will obtain multiple backdoor models provided by the attacker, or the model trained by the poisoned data set will be easily implanted with backdoors by the attacker. The success rate of this attack method is very high, and even the current mainstream defense methods cannot completely delete all backdoors in the model, which provides important research value for multi-backdoor defense and is of great significance for warning the risks of neural network models. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 This is an overall attack flow chart of an image classification experiment in an embodiment of the present invention;
[0036] Figure 2 A trigger display diagram of an image classification experiment in an embodiment of the present invention;
[0037] Figure 3 This is a backdoor image display diagram of an image classification experiment in an embodiment of the present invention;
[0038] Figure 4 This is a diagram for verifying the effectiveness of Grad-CAM defense in the image classification experiment in an embodiment of the present invention. DETAILED DESCRIPTION
[0039] The present invention will be further described in detail below with reference to the accompanying drawings and by way of examples. The following examples are intended to explain the present invention but the present invention is not limited to the following examples.
[0040] 1. Embodiments of the present invention.
[0041] In this embodiment, there are two identities, namely the attacker and the victim. The attacker needs to generate triggers of different targets from the data set provided by the victim, and contaminate part of the original data set (0.1% for each target) in a data set poisoning mode without changing the original label of the data, and needs to successfully provide the model with the backdoor to the victim.
[0042] Taking the CIFAR-10 dataset as an example, the backdoor is implanted from the attacker's perspective. This embodiment includes the following steps:
[0043] Step 1: Proxy model preparation.
[0044] The victim provides the original data set to be trained to the attacker. The attacker needs to first train a model with a good prediction rate for the original data set as a proxy model to ensure that triggers strongly associated with the target class are generated later. The proxy model is trained iteratively using the following formula:
[0045]
[0046] in is the final trained proxy model, θ * is the optimal parameter of the surrogate model, x i and i It is the annotation of the original data set. After about 200 rounds of iterations, a better proxy model can be formed.
[0047] Step 2: Generate trigger.
[0048] With the proxy model, the attacker randomly initializes 32x32 random global noise, whose size depends on the size of the original dataset; then the attacker needs to extract all the data of the target class to be attacked from the original dataset, that is, when the trigger of target class 1 needs to be trained, only the data of target class 1 needs to be extracted, and so on. The target class data is fused with the randomly initialized noise, and then the data is put into the proxy model for training, and the small batch stochastic gradient descent method is used to generate triggers.
[0049] For a target class 1, its trigger is generated by the following formula:
[0050]
[0051] This formula assumes that the trigger generation of target class 1 is presented. In order to finally obtain a trigger with good relevance to target class 1; It is the data of target class 1; The loss function needs to be repeatedly trained to ensure that the backdoor can be triggered correctly; is the proxy model; δ1 is the initialization noise.
[0052] Because it is a multi-target attack, this step needs to be performed multiple times to generate multiple triggers. After iterating the above formula, the attacker will obtain triggers that have a strong correlation with target features. Through the training of the proxy model and target class data, the noise can be optimized through repeated iterations, such as Figure 2 shown.
[0053] Step 3: Injection of trigger.
[0054] Inject poisoned data into the dataset. After the trigger is obtained, the target class data needs to be merged with the trigger of the target class. Since it is a clean label attack, the label is not modified. Only a small part of the data needs to be injected. Since it is a 10-category dataset, take out the data of one category and poison 1%, which is 0.1% of the total.
[0055] First, extract the target class data from the original data set and add the corresponding trigger generated in Step 2 for fusion, such as Figure 3 As shown in the figure, since it is a multi-target attack, we need to remove several other attack target classes and add corresponding triggers.
[0056] The fused data set is then added to the remaining clean data of the original data set to form a complete poisoned data set. After the final poisoned data set is obtained, the poisoned data set is trained. When the poisoned data set converges, the attacker can obtain a model that has a high prediction rate for clean data in the Cifar-10 data set and has multiple backdoors.
[0057] Step 4: Model attack.
[0058] However, in actual attacks, using multiple triggers to activate backdoors is quite troublesome. Since the original triggers carry the characteristic of the target class feature pair, the attacker can fuse the triggers. The attacker uses a spatial frequency domain-based transformation to fuse multiple triggers and obtain a single fused trigger that can be used to activate multiple backdoors. The specific fusion steps are as follows:
[0059] (1) The trigger obtained in step 2 is converted from the spatial domain to the frequency domain. The attacker uses the Floyd fast conversion to achieve the following formula:
[0060]
[0061] where δ / is the trigger obtained by converting the original trigger δ from the spatial domain to the frequency domain. u and v represent the discrete frequency indexes in two directions respectively, and (u, v) is the coordinate corresponding to the trigger in the frequency domain. The double summation symbol indicates the accumulation of all spatial points of the two-dimensional signal, ranging from x = 0 to M-1, and from y = 0 to N-1, that is, the summation is performed on each pixel of the signal matrix. M and N are the length and width of the trigger. δ(x, y) is the two-dimensional discrete signal value in the spatial domain, corresponding to the pixel value of the image or other two-dimensional data at the position (x, y). is a complex exponential factor, which is the kernel function of Fourier transform. Its specific meaning is:
[0062] e -represents a complex number where j is an imaginary unit, its magnitude is 1, and its angle is (radians);
[0063] 2: represents a complete cycle;
[0064] and They are the normalized relationship between the spatial coordinates (x, y) and the frequency coordinates (u, v), reflecting the periodicity of the discrete signal.
[0065] (2) The converted multiple triggers are fused. Here, the soft fusion method is used. The formula is as follows:
[0066]
[0067] Where λ is the trigger fusion hyperparameter, which is used to control the characteristics of each trigger in the fused trigger.
[0068] (3) The fused triggers in the frequency domain are then converted back to the spatial domain. The conversion formula is as follows:
[0069]
[0070] in Represents the spatial domain signal value obtained by two-dimensional discrete Fourier inverse transform, corresponding to the pixel value of the image at position (x, y), which is the optimal fusion trigger obtained. (x, y) is the coordinate of the trigger in the spatial domain. M and N are the length and width of the trigger. is a factor used for normalization to ensure that the amplitude is correct after Fourier transformation and inverse transformation. The double summation symbol indicates the accumulation operation of all points in the frequency domain, ranging from u = 0 to M-1, and from v = 0 to N-1; Represents the value of the frequency domain signal, corresponding to the frequency component of the frequency coordinate (u,v). is a complex exponential term, which is the kernel function of the inverse Fourier transform. Compared with ej in the forward transform, here is e j , indicating that the transformation direction is opposite, that is, from the frequency domain back to the spatial domain, restoring the frequency information to the corresponding spatial signal.
[0071] Finally, the resulting model with backdoor is attacked using fused triggers.
[0072] After the above steps, a model with a backdoor will be obtained, namely And it can also make the model That is, the model can add triggers The image can be identified as target class 1 or target 2, which forms a multi-target attack with fused triggers. In addition, since the multiples of the enhanced triggers are in the testing phase, they will be strictly reviewed during the training phase. However, in the testing phase, since the model has been launched, the test cases are often not reviewed.
[0073] The attacker can return the model to the victim. When the victim inputs a clean image into the model, it does not affect the accuracy of the model, making the backdoor undetectable. On the contrary, the attacker only needs to activate the corresponding backdoor to attack the target class he wants to attack. That is, when attacking target class 1, he only needs to enhance the trigger feature of target class 1 in the fusion trigger. You can view the attack phase. Figure 1 , so that the attacker can accurately attack any target he wants to attack, or activate any backdoor.
[0074] 2. Image classification experiment.
[0075] 1. Dataset and model structure.
[0076] This implementation case uses two standard small datasets CIFAR-10 and CIFAR-100 and a large dataset CelebA Subset face dataset as test data, and selects a unified model architecture ResNet-18. The detailed information is shown in Table 1.
[0077] Table 1.
[0078] Dataset Classification size quantity Model CIFAR-10 10 32×32×3 50000 ResNet-18 CIFAR-100 100 32×32×3 50000 ResNet-18 CelebA Subset 8 224×224×3 162084 ResNet-18
[0079] 2. Experimental setup.
[0080] In this implementation case, for the backdoor poisoning data, the Adam optimizer is used to train the backdoor model for 200 epochs, and the learning rate is set to 0.001. Since the attack targets of Badnets and SIG are both the same, in order to highlight the advantages of multiple targets, the targets of both attacks are changed. The target labels of Badnets and SIG poisoning attacks are set to 0 and 1. See Table 2 for the settings of the attack methods.
[0081] Table 2.
[0082] Attack Method type pattern Target Poisoning ratio BadNets fixed Square 0,1 1％ SIG fixed Sin perturbation 0,1 1％ FMBA(ours) fixed noise 0,1 0.5％
[0083] 3. Experimental results
[0084] Attack effectiveness experimental results:
[0085] This experiment evaluates the results of three datasets (CIFAR-10, CIFAR-100, CelebA) on two backdoor poisoning attacks. The evaluation criteria for the effectiveness of backdoor poisoning attacks are attack success rate and clean data accuracy. The experimental results are shown in Table 3:
[0086] Table 3
[0087]
[0088] Grad-CAM visualizes the areas that the neural network focuses on through heatmaps. Figure 4 As shown in the figure, the first column is the attention of the neural network when there is no trigger for the clean image. The second and third columns are the visualization results after the backdoor and poisonous trigger are implanted, respectively. It can be found that the attention of the neural network to the image after the trigger is implanted does not change much, indicating that the backdoor model can evade the defense.
[0089] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A poisoning attack method based on multi-backdoor fusion of space-frequency domain conversion, characterized by: The following steps are involved: Step 1: Proxy model preparation; Generate a model with good prediction rate for the original dataset provided by the victim as a proxy model; Step 2: trigger generation; After obtaining the proxy model, the attacker extracts the target class data to be attacked from the original data set, fuses the target class data with randomly initialized noise, then puts the data into the proxy model for training, and uses the small batch stochastic gradient descent method to generate triggers; Step 3: Trigger injection; After having the trigger, merge the data of the target class with the trigger of the target class; Then, the fused dataset is added to the remaining clean data in the original dataset to form a complete poisoned dataset. Finally, the poisoned dataset is trained. When the poisoned dataset converges, a model with multiple backdoors will be obtained. Step 4: Model attack; Prepare multiple triggers to trigger the corresponding backdoors, and fuse these triggers to obtain a single fused trigger for activating multiple backdoors; Use fused triggers to attack the resulting backdoored model.
2. According to claim 1, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized by: The proxy model Generated by the following formula: in is the final trained proxy model, θ * is the optimal parameter of the surrogate model, x i and i It is the annotation of the original dataset.
3. According to claim 1, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized by: In step 2, for a target class 1, its trigger is generated by the following formula: in In order to finally obtain a trigger with good relevance to target class 1; It is the data of target class 1; is the loss function; is the proxy model; δ1 is the initialization noise.
4. According to claim 1, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized by: In step 4, the specific fusion steps are as follows: (1) Convert the trigger obtained in step 2 from the spatial domain to the frequency domain; (2) then fusing the converted multiple triggers; (3) Subsequently, the fused triggers in the frequency domain are converted back to the spatial domain.
5. According to claim 4, a poisoning attack method based on space-frequency domain conversion and multiple backdoor fusion is characterized in that: In the fusion step (1), the trigger is converted from the spatial domain to the frequency domain using the Floyd fast transform.
6. According to claim 5, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized in that: The conversion formula is as follows: where δ / is the trigger obtained by converting the original trigger δ from the spatial domain to the frequency domain, (u, v) is the coordinate corresponding to the trigger in the frequency domain; the double summation symbol indicates the accumulation of all spatial points of the two-dimensional signal, ranging from x = 0 to M-1, and from y = 0 to N-1, that is, the summation is performed on each pixel of the signal matrix; M and N are the length and width of the trigger; δ(x, y) is the two-dimensional discrete signal value in the spatial domain, corresponding to the pixel value of the image or other two-dimensional data at the position (x, y); is the complex exponential factor.
7. According to claim 4, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized by: In the fusion step (2), the soft fusion method is used, and the formula is as follows: Where λ is the trigger fusion hyperparameter.
8. According to claim 4, a poisoning attack method based on multiple backdoor fusion of space-frequency domain conversion is characterized by: In the fusion step (3), the conversion formula is as follows: in is the optimal fusion trigger obtained, (x, y) is the coordinate domain of the trigger in space; M and N are the length and width of the trigger; is a factor used for normalization; the double summation symbol indicates the accumulation operation of all points in the frequency domain, ranging from u = 0 to M-1, and from v = 0 to N-1; Represents the value of the frequency domain signal, corresponding to the frequency component of the frequency coordinate (u, v); is a complex exponential term.