Backdoor poisoning defense method and system for intelligent identification of communication signals

Abstract

The embodiments of the present application relate to the field of countermeasure defense technology, and in particular to a backdoor poisoning defense method and system for intelligent recognition of communication signals, the method comprising: inputting a training data set and a clean data set into a recognition network respectively, obtaining the maximum prediction probability of the recognition network for the training data set and the clean data set; dividing the maximum prediction probability for the training data set and the clean data set according to categories respectively, calculating the high prediction probability ratio of each category of the training data set and the clean data set, and determining the category of the poisoned sample; using a clustering algorithm to perform binary clustering on all samples in the category where the poisoned sample is located, calculating the high prediction probability ratio of each of the two sample clusters, and determining the poisoned sample cluster; training the recognition network based on the anti-learning of the poisoned sample cluster to realize backdoor poisoning defense of the recognition network. This method can effectively eliminate the backdoor effect of the recognition network and maintain the recognition ability of clean samples.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of countermeasure defense technology, and in particular to a backdoor poisoning defense method and system for intelligent identification of communication signals. Background Art

[0002] In recent years, deep learning has achieved tremendous success in fields such as natural language processing, intelligent communication signal recognition, and computer vision. Deep neural networks offer the following advantages: First, they can be trained using vast amounts of data. This wealth of sample data contains rich information, helping models discover complex relationships and hidden features between samples, significantly improving task processing capabilities. In tasks such as modulated signal recognition and image recognition, they can surpass the performance of traditional methods and the human eye. Second, deep neural networks, with their powerful feature extraction and nonlinear processing capabilities, can automatically extract features, reducing the constraints of specialized expertise and practical experience. Third, thanks to the rapid development of artificial intelligence and the rapid iteration and upgrading of deep learning technology, deep neural networks have enormous potential to solve even more complex problems in the future.

[0003] However, deep learning's interpretability limitations make deep neural network models less secure and reliable. Backdoor poisoning attackers can add poisoned samples with specific triggers to training datasets and assign specific label categories to these samples. Using these triggers, they can manipulate the infected model's behavior on specific data and launch attacks. This significantly impacts the usability and reliability of intelligent systems that rely on deep learning. Therefore, designing defenses against backdoor poisoning attacks is crucial.

[0004] Currently, research teams both domestically and internationally have proposed several backdoor poisoning defenses. Classic backdoor poisoning defense methods include spectral detection, activation clustering, neural pruning, fine-tuning, and neural attention distillation. These poisoned sample detection algorithms require extracting deep features from samples to make judgments. Pruning or distillation-based backdoor elimination methods also easily affect the network parameter structure, reducing the ability to identify clean samples. Therefore, it is possible to consider observing the recognition mechanism of poisoned samples that differs from clean samples, designing a detection method with lower computational complexity, and improving the backdoor elimination algorithm to reduce the probability of being triggered by backdoor triggers without significantly affecting the network parameter structure, thereby achieving defense against backdoor poisoning attacks.

[0005] Through the above analysis, the currently proposed backdoor poisoning defense methods still have the following defects.

[0006] First, the currently proposed poisoned sample detection methods need to extract deep features of the samples to make judgments on the samples, which consumes a lot of time and computing resources.

[0007] Second, the backdoor elimination methods currently proposed can easily have a significant impact on the network parameter structure, reducing the model's ability to recognize clean samples. Summary of the Invention

[0008] To solve the above technical problems, the embodiments of the present application propose a backdoor poisoning defense method and system for intelligent identification of communication signals. It does not require the extraction of deep features of samples, the calculation is simple, and the consumption of time and computing resources is greatly reduced. It can effectively eliminate the backdoor effect of the identification network without causing a significant impact on the network parameter structure. While achieving backdoor poisoning defense, it maintains the ability to identify clean samples.

[0009] To achieve the above-mentioned purpose, an embodiment of the present application proposes a backdoor poisoning defense method for intelligent identification of communication signals, the method comprising: inputting a training data set and a clean data set into a recognition network respectively, obtaining the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set; wherein the recognition network is obtained by iterative training based on the training data set; dividing the maximum prediction probability for the training data set and the maximum prediction probability for the clean data set according to categories respectively, calculating the high prediction probability ratio of each category of the training data set and the clean data set based on a preset high prediction probability threshold, comparing the high prediction probability ratio of the same category of the training data set and the clean data set, and determining the category to which the poisoned sample belongs; using the K-means clustering algorithm to perform binary clustering on all samples in the category to which the poisoned sample belongs, calculating the high prediction probability ratio of each of the two sample clusters, and determining the poisoned sample cluster; training the recognition network based on the anti-learning of the poisoned sample cluster, destroying the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, and realizing backdoor poisoning defense of the recognition network.

[0010] To achieve the above-mentioned objectives, an embodiment of the present application also provides a backdoor poisoning defense system for intelligent identification of communication signals, the system comprising: a recognition network prediction module, for inputting a training data set and a clean data set into the recognition network respectively, and obtaining the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set, wherein the recognition network is obtained by iterative training based on the training data set; a poisoned sample positioning module, for dividing the maximum prediction probability for the training data set and the maximum prediction probability for the clean data set according to categories, calculating the high prediction probability ratio of each category of the training data set and the clean data set based on a preset high prediction probability threshold, and comparing the high prediction probability ratio of the same category of the training data set and the clean data set to determine the category to which the poisoned sample belongs; a poisoned sample separation module, for using the K-means clustering algorithm to perform binary clustering on all samples in the category to which the poisoned sample belongs, calculating the high prediction probability ratio of each of the two sample clusters, and determining the poisoned sample cluster; an anti-learning training module, for anti-learning training of the recognition network based on the poisoned sample cluster, destroying the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, and realizing backdoor poisoning defense of the recognition network.

[0011] To achieve the above-mentioned objectives, an embodiment of the present application also proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a backdoor poisoning defense method for intelligent identification of communication signals as described above.

[0012] To achieve the above-mentioned purpose, an embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a backdoor poisoning defense method for intelligent identification of communication signals as described above.

[0013] In some optional embodiments, the training data set D train The recognition network F is mastered by a third party, and the clean dataset D clean controlled by the defender;

[0014] The maximum prediction probability of the identification network for the training data set and the maximum prediction probability for the clean data set are expressed by the following formula

[0015]

[0016]

[0017] in, Denotes the training dataset Dtrain The i-th sample in , For the training data set D train The predicted probability value of the i-th sample belonging to the j-th category, n is the total number of categories, and the training data set D train and clean dataset D clean The categories contained in For the training data set D train The predicted probability vector of the i-th sample in , max(·) is the maximum value function, For the training data set D train The maximum predicted probability of the i-th sample in, Denotes the clean dataset D clean The i-th sample in , For the clean dataset D clean The predicted probability value of the i-th sample in belongs to the j-th category, For the training data set D clean The predicted probability vector of the i-th sample in, For the clean dataset D clean The maximum predicted probability of the i-th sample in .

[0018] In some optional embodiments, the maximum prediction probability for the training dataset and the maximum prediction probability for the clean dataset are divided into categories, and the high prediction probability ratio of each category of the training dataset and the clean dataset is calculated based on a preset high prediction probability threshold, which is achieved by the following formula:

[0019]

[0020] in, Denotes the training dataset D train The ath sample in the jth category, τ is the preset high prediction probability threshold, Represents the training data set d train The maximum predicted probability of the ath sample belonging to the jth category in the training dataset D train The total number of samples belonging to the jth category in , Denotes the training dataset D train The proportion of high prediction probabilities of the j-th category in , Denotes the clean dataset D clean The ath sample in belongs to the jth category, Denotes the clean dataset D clean The maximum predicted probability of the a-th sample belonging to the j-th category in, Denotes the clean dataset D cleanThe proportion of high predicted probabilities of the j-th category in , where I(·) is the counting function.

[0021] In some optional embodiments, the high prediction probability ratios of the same category in the training data set and the clean data set are compared to determine the category to which the poisoned sample belongs, including: traversing each category and calculating the first difference between the high prediction probability ratios of the training data set and the clean data set under the current category; if the absolute value of the first difference is greater than a first preset threshold, and the high prediction probability ratio of the training data set is greater than the high prediction probability ratio of the clean data set, then the current category is determined to be the category to which the poisoned sample belongs; if the absolute value of the first difference is greater than the first preset threshold, and the high prediction probability ratio of the training data set is less than the high prediction probability ratio of the clean data set, then it is determined that the training data set is incorrect; if the absolute value of the first difference is less than or equal to the first preset threshold, then the first difference between the high prediction probability ratios of the training data set and the clean data set under the next category is calculated.

[0022] In some optional embodiments, a K-means clustering algorithm is used to perform dichotomy on all samples in the category of the poisoned sample, and the proportion of high predicted probabilities of the two sample clusters is calculated to determine the poisoned sample cluster, including:

[0023] Randomly determine two initial points c1 and c2 as the centroids, calculate the distance between each poisoned sample in the poisoned sample cluster and each centroid, and assign each poisoned sample to the sample cluster represented by the nearest centroid, resulting in two sample clusters in total;

[0024] Update the centroid of each sample cluster to the average value of all its samples, repeat the sample cluster assignment and the update of the sample cluster centroid until the sample cluster centroid no longer changes significantly or reaches the preset maximum number of updates, and finally obtain the two sample clusters;

[0025] Calculate the high prediction probability ratios of the final two sample clusters respectively and compare them, and determine the sample cluster with a higher high prediction probability ratio as the poisoning sample cluster;

[0026] The poisoned sample cluster is represented by the following formula:

[0027]

[0028] in, represents the e-th poisoned sample, Represents the set of all samples in the category of the poisoned sample, y target Indicates the attack category specified by the attacker. Indicates a cluster of poisoned samples.

[0029] In some optional embodiments, in the process of training the recognition network based on the anti-learning of the poisoned sample cluster, destroying the strong association between the backdoor trigger of the recognition network and the attacker's specified category and the poisoned sample, and realizing the backdoor poisoning defense of the recognition network, the anti-learning training loss function used is expressed by the following formula:

[0030]

[0031] Among them, B represents the number of clean samples and separated poisoned samples in the current training batch, y b,j Represents the value at the jth position on the bth true label, y target,j The value at the jth position on the label of the attack category specified by the attacker, F(x b ) j It represents the predicted probability of the recognition network for the bth clean sample belonging to the jth category, represents the predicted probability of the recognition network for the bth poisoned sample belonging to the jth category, t represents the number of iterations, L represents the total number of layers of the recognition network, and θ t,l represents the network parameter vector of the lth layer of the recognition network at the tth iteration, θ 0,l represents the network parameter vector of the first layer of the identification network at the initial stage, ‖·‖1 represents the L1 norm, α and β are the preset weight coefficients, represents the anti-learning training loss function at the tth iteration.

[0032] In some optional embodiments, in the process of training the recognition network based on the poisoned sample cluster through reverse learning, destroying the strong association between the backdoor trigger of the recognition network and the attacker-specified category and the poisoned sample, and realizing backdoor poisoning defense of the recognition network, a final reverse learning loss function is obtained based on the reverse learning training loss function, and the recognition network is reversely trained using the final reverse learning loss function;

[0033] The final loss function of anti-learning is expressed by the following formula:

[0034]

[0035] Among them, sign(·) is the sign function, γ is the preset loss threshold, and loss t Represents the final loss function of anti-learning at the tth iteration.

[0036] The embodiment of the present application proposes a backdoor poisoning defense method for intelligent identification of communication signals, which has the following advantages and positive effects.

[0037] First, this application obtains the maximum prediction probability of the training data set and the clean data set, and then calculates the high prediction probability ratio of the maximum prediction probability of the two data sets to quickly and accurately locate the poisoned categories in the training data set. Finally, the K-means clustering method is used to highly accurately separate the poisoned samples mixed in the training data set, and anti-learning training is performed to eliminate the backdoor effect of the backdoor model, thereby achieving defense against backdoor poisoning attacks.

[0038] Second, this application adopts a poisoned sample detection method based on predicted probability distribution. Compared with previous poisoned sample detection and separation algorithms, this application does not need to extract deep features of the sample, the calculation is simple, and the consumption of time and computing resources is greatly reduced.

[0039] Third, this application adopts a new anti-learning training algorithm and optimizes the anti-learning training loss function. Compared with the traditional anti-learning training algorithm, it can effectively eliminate the backdoor effect of the recognition network without causing a major impact on the network parameter structure. While achieving defense against backdoor poisoning attacks, it maintains the ability to recognize clean samples and effectively curbs the occurrence of catastrophic forgetting. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related technologies, the following is a brief introduction to the drawings required for use in the embodiments of the present application or the description of the related technologies. Obviously, the following drawings are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings described here are only used to explain the present application and are not used to limit the present application.

[0041] Figure 1 This is a flowchart of a backdoor poisoning defense method for intelligent identification of communication signals provided in one embodiment of the present application;

[0042] Figure 2 This is a performance comparison chart of the method provided in one embodiment of the present application and the traditional backdoor defense method under a 5% poisoning rate;

[0043] Figure 3 This is a performance comparison chart of the method provided in one embodiment of the present application and the traditional backdoor defense method under a 10% poisoning rate;

[0044] Figure 4 This is a performance comparison chart of the method provided in one embodiment of the present application and the traditional backdoor defense method under a 15% poisoning rate;

[0045] Figure 5This is a schematic diagram of the structure of a backdoor poisoning defense system for intelligent identification of communication signals provided in another embodiment of the present application;

[0046] Figure 6 It is a structural diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below with reference to the accompanying drawings. Those skilled in the art will appreciate that in each embodiment of the present application, many technical details are provided to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present application can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present application. The various embodiments can be combined with each other and referenced to each other under the premise of no contradiction.

[0048] One embodiment of the present application proposes a backdoor poisoning defense method for intelligent identification of communication signals, which is applied to electronic devices, where the electronic device can be a terminal or a server, that is, the defender hereinafter. This embodiment and the following embodiments are described with the defender as the execution subject. The following is a detailed description of the implementation details of the backdoor poisoning defense method for intelligent identification of communication signals proposed in this embodiment. The following content is only provided for the convenience of understanding and is not required for the implementation of this solution.

[0049] The specific process of the backdoor poisoning defense method for intelligent identification of communication signals proposed in this embodiment can be as follows: Figure 1 Shown, including:

[0050] S1, input the training data set and the clean data set into the recognition network respectively, and obtain the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set, wherein the recognition network is obtained by iterative training based on the training data set.

[0051] In practice, the defender first needs to obtain a training dataset, a recognition network, and a clean dataset. The training dataset and recognition network are held by a third party. The recognition network is iteratively trained based on the training dataset, while the clean dataset is held by the defender. The training dataset has been poisoned by the attacker, while the clean dataset is guaranteed to be unpoisoned. After obtaining the training dataset and recognition network, the defender can input the training dataset and clean dataset into the recognition network, respectively, to obtain the recognition network's maximum prediction probability for the training dataset and the clean dataset. The recognition network's maximum prediction probability for the training dataset and the clean dataset are both stored in vector form.

[0052] In one example, the training dataset is denoted as D train , the clean data set is recorded as D clean , the recognition network is recorded as F, the training data set D train The recognition network F is mastered by a third party, and the clean dataset D clean Mastered by the defense. Identify the network F for the training data set D train The maximum predicted probability and the maximum predicted probability for the clean data set D clean The maximum predicted probability is expressed by the following formula:

[0053]

[0054] in, Denotes the training dataset D train The i-th sample in , For the training data set D train The predicted probability value of the i-th sample belonging to the j-th category, n is the total number of categories, and the training data set D train and clean dataset D clean The categories contained in For the training data set D train The predicted probability vector of the i-th sample in , max(·) is the maximum value function, For the training data set D train The maximum predicted probability of the i-th sample in, Denotes the clean dataset D clean The i-th sample in , For the clean dataset D clean The predicted probability value of the i-th sample in belongs to the j-th category, For the training data set D clean The predicted probability vector of the i-th sample in, For the clean dataset D clean The maximum predicted probability of the i-th sample in .

[0055] S2: Divide the maximum prediction probability of the training dataset and the maximum prediction probability of the clean dataset into categories, calculate the high prediction probability ratio of each category of the training dataset and the clean dataset based on the preset high prediction probability threshold, compare the high prediction probability ratio of the same category of the training dataset and the clean dataset, and determine the category of the poisoned sample.

[0056] In the specific implementation, the defender obtains the recognition network F for the training data set D train The maximum predicted probability and the maximum predicted probability for the clean data set D clean After the maximum prediction probability of the training data set D train The maximum predicted probability and the maximum predicted probability for the clean data set D clean The maximum prediction probability is divided into categories, and the training data set D is calculated based on the preset high prediction probability threshold. train and clean dataset D clean The proportion of high prediction probability of each category is compared with the training data set D train and clean dataset D cleen The high prediction probability ratio of the same category can be used to determine the category of the poisoned sample. The preset high prediction probability threshold can be set by those skilled in the art according to actual needs.

[0057] In an example, the defender will arain The maximum predicted probability and the maximum predicted probability for the clean data set D clean The maximum prediction probability is divided into categories, and the training data set D is calculated based on the preset high prediction probability threshold. train and clean dataset D clean The proportion of high prediction probability of each category can be achieved by the following formula:

[0058]

[0059] in, Denotes the training dataset D train The ath sample in the jth category, τ is the preset high prediction probability threshold, Denotes the training dataset D train The maximum predicted probability of the ath sample belonging to the jth category in the training dataset D train The total number of samples belonging to the jth category in , Denotes the training dataset D train The proportion of high prediction probabilities of the j-th category in , Denotes the clean dataset D cleanThe ath sample in belongs to the jth category, Denotes the clean dataset D clean The maximum predicted probability of the a-th sample belonging to the j-th category in, Denotes the clean dataset D clean The proportion of high predicted probabilities of the j-th category in , where I(·) is the counting function.

[0060] It is understandable that since the recognition network (backdoor network model) identifies poisoned samples by identifying triggers, the form of the trigger is simpler than the characteristics of the sample itself, so the judgment on poisoned samples will be more absolute. If poisoned samples are mixed into a certain sample set, then the proportion of high prediction probabilities in the sample set should be significantly increased.

[0061] Based on this, the defender needs to traverse each category and calculate the training data set D under the current category. train and clean dataset D clean If the absolute value of the first difference is greater than the first preset threshold, and the training data set D train The proportion of high prediction probability is greater than that of the clean dataset D clean If the absolute value of the first difference is greater than the first preset threshold, and the training data set D train The proportion of high prediction probability is smaller than that of the clean dataset D clean The proportion of high prediction probabilities of the training dataset D train If the absolute value of the first difference is less than or equal to the first preset threshold, the training data set D is calculated for the next category. train and clean dataset D clean The first difference between the proportions of high predicted probabilities.

[0062] In the absence of poisoning, the training data set D train and clean dataset D clean There will be no significant difference in the proportion of high prediction probabilities. If a certain category is mixed with poisoned samples, then the training dataset D in this category train The proportion of high prediction probability of the clean dataset D clean The high prediction probability ratio of , which can be located in the training data set D train The category of poisoning.

[0063] S3, use the K-means clustering algorithm to perform dichotomy on all samples in the category of the poisoned sample, calculate the proportion of high prediction probabilities of the two sample clusters, and determine the poisoned sample cluster.

[0064] In the specific implementation, the defender locates the training dataset D train After the poisoned category is identified, the K-means clustering algorithm (K=2) can be used to perform binary clustering on all samples in the category where the poisoned sample is located, and the proportion of high prediction probabilities of the two sample clusters is calculated to determine the poisoned sample cluster.

[0065] The defender first randomly determines K initial points c=[c1,c2,…,c k ,…,c K ] as the centroid (since it is a binary cluster, only two initial points c1 and c2 need to be randomly determined as the centroid), calculate the distance between each poisoned sample in the poisoned sample cluster and each centroid, and assign each poisoned sample to the sample cluster represented by the nearest centroid, and obtain two sample clusters in total.

[0066] The sample cluster assignment process can be expressed by the following formula:

[0067] c j =argmin i ||x j -c i || 2 ;

[0068] Among them, c j Represents sample x j The centroid of the sample cluster to which it belongs.

[0069] The defender then updates the centroid of each sample cluster to the average of all its samples. This process of assigning sample clusters and updating the centroids is repeated until the centroids no longer change significantly or the preset maximum number of updates is reached, resulting in the final two sample clusters. At this point, each sample is assigned to the cluster closest to it, achieving clustering.

[0070] The process of updating the centroid of each sample cluster to the average value of all its samples can be expressed by the following formula:

[0071]

[0072] Among them, s j Indicates that it belongs to sample cluster c j A collection of samples.

[0073] Finally, the defender calculates the proportion of high prediction probabilities for the final two sample clusters, compares them, and identifies the sample cluster with a higher proportion of high prediction probabilities as the poisoned sample cluster. The poisoned sample cluster can be represented by the following formula:

[0074]

[0075] in, represents the e-th poisoned sample, Represents the set of all samples in the category of the poisoned sample, y target Indicates the attack category specified by the attacker. Indicates a cluster of poisoned samples.

[0076] It is understandable that by using the K-means clustering algorithm and setting K to 2, the sample set containing poisoned samples can be divided into two sample clusters: poisoned samples and clean samples. The sample set containing poisoned samples is defined as X s , by clustering, X s Will be divided into two sample sets X s1 and X s2 , then calculate X separately s1 、X s2 The proportion of high predicted probabilities in the sample cluster where the poisoned sample is located will be significantly higher than that in the other sample cluster, thereby separating the poisoned samples.

[0077] S4, based on the anti-learning training of the poisoned sample cluster, destroys the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, thus realizing the backdoor poisoning defense of the recognition network.

[0078] In the specific implementation, after separating the poisoned sample cluster, the defender can train the recognition network based on the poisoned sample cluster to destroy the backdoor trigger of the recognition network and the category y specified by the attacker. target The strong correlation between the poisoned samples reduces the probability of the backdoor trigger being triggered, thereby achieving backdoor poisoning defense in the identification network.

[0079] In one example, the defender uses the anti-learning training loss function to train the recognition network based on the poisoned sample cluster, destroying the recognition network's backdoor trigger and the strong association between the attacker's specified category and the poisoned sample, thereby implementing backdoor poisoning defense for the recognition network. The formula is:

[0080]

[0081] Among them, B represents the number of clean samples and separated poisoned samples in the current training batch, y b,j represents the value of the jth position on the bth true unique hot label (the value is 0 or 1), y target,j The value of the jth position on the unique hot label of the attack category specified by the attacker (the value is 0 or 1), F(x b ) j It represents the predicted probability of the recognition network for the bth clean sample belonging to the jth category, represents the predicted probability of the recognition network that the bth poisoned sample belongs to the jth category, t represents the number of iterations, L represents the total number of layers of the recognition network, and θ t,l represents the network parameter vector of the lth layer of the recognition network at the tth iteration, θ 0,l represents the network parameter vector of the first layer of the identification network at the initial stage, ‖·‖1 represents the L1 norm, α and β are the preset weight coefficients, represents the anti-learning training loss function at the tth iteration.

[0082] It is worth noting that This loss term conforms to the standard cross entropy loss function, which is used to maintain the recognition ability of clean samples during the anti-learning process and avoid accidentally damaging clean samples. This loss term adds a negative sign before the cross entropy loss function, which is used for reverse training to destroy the attacker's specified category y target Strong correlation with poisoned samples. It exists as a network parameter penalty term to limit excessive changes in network parameters and prevent catastrophic forgetting of the recognition network.

[0083] In one example, in order to further limit the catastrophic forgetting problem caused by the continuous decrease of the loss function value during the anti-learning process, the defender trained the loss function based on the anti-learning to obtain the final anti-learning loss function, and used the final anti-learning loss function to train the recognition network. This limits the loss function value from decreasing without limit, curbing the catastrophic forgetting of the recognition network.

[0084] The final loss function of anti-learning can be expressed by the following formula:

[0085]

[0086] Among them, sign(·) is the sign function, γ is the preset loss threshold, and loss t Represents the final loss function of anti-learning at the tth iteration.

[0087] The backdoor poisoning defense method for intelligent identification of communication signals proposed in this embodiment has the following advantages and positive effects.

[0088] First, this application obtains the maximum prediction probability of the training data set and the clean data set, and then calculates the high prediction probability ratio of the maximum prediction probability of the two data sets to quickly and accurately locate the poisoned categories in the training data set. Finally, the K-means clustering method is used to highly accurately separate the poisoned samples mixed in the training data set, and anti-learning training is performed to eliminate the backdoor effect of the backdoor model, thereby achieving defense against backdoor poisoning attacks.

[0089] Second, this application adopts a poisoned sample detection method based on predicted probability distribution. Compared with previous poisoned sample detection and separation algorithms, this application does not need to extract deep features of the sample, the calculation is simple, and the consumption of time and computing resources is greatly reduced.

[0090] Third, this application adopts a new anti-learning training algorithm and optimizes the anti-learning training loss function. Compared with the traditional anti-learning training algorithm, it can effectively eliminate the backdoor effect of the recognition network without causing a major impact on the network parameter structure. While achieving defense against backdoor poisoning attacks, it maintains the ability to recognize clean samples and effectively curbs the occurrence of catastrophic forgetting.

[0091] The steps of the various methods described above are divided for clarity of description only. They can be combined into a single step, or some steps can be broken down into multiple steps. As long as they share the same logical relationships, they are all within the scope of protection of this application. Adding minor modifications or introducing minor design changes to the algorithm or process, but not changing the core design of the algorithm or process, is also within the scope of protection of this application.

[0092] In one embodiment, in order to evaluate the performance of a backdoor poisoning defense method for intelligent identification of communication signals proposed in this application (hereinafter referred to as this method), we conducted a simulation experiment. In the simulation experiment, PyCharm simulation software was used, and the experimental data set can be from the open source simulation data set RADIOML.2016.10B designed by DeepSIG. RADIOML.2016.10B is the most authoritative public data set in the field of wireless communication technology, containing 10 modulation modes, 20 signal-to-noise ratio environments, and a total of 1,200,000 data. 800,000 samples were randomly selected from the 1,200,000 data samples of the original data set. According to different poisoning rates, triggers were added to a certain number of samples to form poisoned samples, and the labels of the corresponding poisoned samples were changed to [0, 0, 1, 0, 0, 0, 0, 0, 0] corresponding to the third modulation category BPSK, to obtain three groups of training sets D with different poisoning rates. bd5％ 、D bd10％ and D bd15％ , with poisoning rates of 5%, 10% and 15% respectively.

[0093] Randomly select 200,000 samples from the remaining 400,000 samples as the clean sample test set D test , and then D test Make a copy and add triggers to all samples in the copied sample set and change the labels to [0,0,1,0,0,0,0,0,0,0] to form a poisoned sample test set The remaining 200,000 samples serve as the clean dataset D in the hands of the defender.clean In the anti-learning training phase, the adaptive distance estimation (Adam) optimization algorithm is used to finally obtain a trained network model. The comparison of the defense effect of this method with traditional defense methods (such as NAD and Fine-Pruning) is shown in the figure. Figure 2 、 Figure 3 and Figure 4 shown. Figure 2 、 Figure 3 and Figure 4 The following are performance comparison charts of this method and traditional backdoor defense methods under 5%, 10% and 15% poisoning rates.

[0094] It can be seen that the defense performance of this method is better than that of traditional representative defense methods. The attack success rate of the recognition network defended by this method under different poisoning rates and different signal-to-noise ratio environments is lower than that of traditional defense methods, which proves the effectiveness of this method.

[0095] Another embodiment of the present application proposes a backdoor poisoning defense system for intelligent identification of communication signals. The following is a detailed description of the backdoor poisoning defense system for intelligent identification of communication signals proposed in this embodiment. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this embodiment. Figure 5 This is a structural diagram of a backdoor poisoning defense system for intelligent recognition of communication signals proposed in this embodiment, which specifically includes: an identification network prediction module M1, a poisoned sample positioning module M2, a poisoned sample separation module M3 and an anti-learning training module M4.

[0096] The recognition network prediction module M1 is used to input the training data set and the clean data set into the recognition network respectively, and obtain the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set, wherein the recognition network is obtained by iterative training based on the training data set.

[0097] The poisoned sample positioning module M2 is used to divide the maximum prediction probability for the training data set and the maximum prediction probability for the clean data set into categories, calculate the high prediction probability ratio of each category of the training data set and the clean data set based on the preset high prediction probability threshold, compare the high prediction probability ratio of the same category of the training data set and the clean data set, and determine the category of the poisoned sample.

[0098] The poisoned sample separation module M3 is used to use the K-means clustering algorithm to perform binary clustering on all samples in the category where the poisoned samples are located, calculate the high prediction probability ratio of each of the two sample clusters, and determine the poisoned sample cluster.

[0099] The anti-learning training module M4 is used to train the recognition network based on the poisoned sample cluster, destroy the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, and realize the backdoor poisoning defense of the recognition network.

[0100] It is not difficult to find that this embodiment is a system embodiment corresponding to the above-mentioned method embodiment, and this embodiment can be implemented in conjunction with the above-mentioned method embodiment. The relevant technical details and technical effects mentioned in the above-mentioned embodiments are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned embodiments.

[0101] It is worth mentioning that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovation of this application, this embodiment does not include units that are not closely related to solving the technical problem proposed by this application. However, this does not mean that other units do not exist in this embodiment.

[0102] Another embodiment of the present application provides an electronic device, the specific structure of which can be as follows: Figure 6 As shown, it includes: at least one processor C1; and a memory C2 communicatively connected to the at least one processor C1; wherein the memory C2 stores instructions that can be executed by the at least one processor C1, and the instructions are executed by the at least one processor C1 so that the at least one processor C1 can execute a backdoor poisoning defense method for intelligent identification of communication signals as described in the above-mentioned method embodiments.

[0103] The memory and processor are connected using a bus, which includes any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and therefore will not be described further in this article. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by the processor is transmitted on a wireless medium via an antenna. Furthermore, the antenna also receives data and transmits it to the processor.

[0104] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0105] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a backdoor poisoning defense method for intelligent identification of communication signals as described in the above method embodiments.

[0106] That is, those skilled in the art will understand that all or part of the steps in the above-described embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (such as a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. Storage media include: U disk, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, etc., various media that can store program code.

[0107] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and that in actual applications, various modifications may be made to the embodiments in form and detail without departing from the spirit and scope of the present application. Those skilled in the art will appreciate that improvements and modifications may be made without departing from the principles of the present application, and such improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A backdoor poisoning defense method for intelligent identification of communication signals, characterized in that: The method comprises: Input the training data set and the clean data set into the recognition network respectively, and obtain the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set; wherein the recognition network is obtained by iterative training based on the training data set; The maximum predicted probabilities for the training dataset and the clean dataset are divided into categories. The high predicted probability ratio of each category in the training dataset and the clean dataset is calculated based on the preset high predicted probability threshold. The high predicted probability ratio of the same category in the training dataset and the clean dataset is compared to determine the category of the poisoned sample. Use the K-means clustering algorithm to perform binary clustering on all samples in the category of the poisoned sample, calculate the proportion of high prediction probabilities in each of the two sample clusters, and determine the poisoned sample cluster; Based on the anti-learning training of poisoned sample clusters, the recognition network is trained to destroy the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, thus achieving backdoor poisoning defense for the recognition network; In the process of training the recognition network based on anti-learning of poisoned sample clusters, destroying the strong association between the backdoor trigger of the recognition network and the attacker's specified category and poisoned samples, and realizing the backdoor poisoning defense of the recognition network, the anti-learning training loss function used is expressed by the following formula: ； in, Indicates the number of clean samples and separated poisoned samples in the current training batch, Indicates the The real label The value at the position, The first tag on the attack category specified by the attacker The value at the position, Represents the recognition network for the The clean sample belongs to The predicted probability of each category, Represents the recognition network for the The poisoned sample belongs to The predicted probability of each category, represents the number of iterations, Represents the total number of layers of the recognition network, Indicates the The first iteration of the identification network The network parameter vector of the layer, Indicates the initial recognition network The network parameter vector of the layer, Indicates taking the L1 norm, and is the preset weight coefficient, Indicates the Anti-learning training loss function at iterations; In the process of training the recognition network based on the poisoned sample cluster, the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample are destroyed to achieve the backdoor poisoning defense of the recognition network. Based on the anti-learning training loss function, the anti-learning final loss function is obtained, and the recognition network is trained using the anti-learning final loss function. The final loss function of anti-learning is expressed by the following formula: ； in, is a symbolic function, is the preset loss threshold, Indicates the The final loss function of the anti-learning at the iteration.

2. A backdoor poisoning defense method for intelligent identification of communication signals according to claim 1, characterized in that: Training dataset and identification network Clean dataset controlled by a third party controlled by the defender; The maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set are expressed by the following formula: ； ； ； ； in, Represents the training dataset The samples, For the training data set The The samples belong to The predicted probability value of each category, is the total number of categories, training data set and clean dataset The categories contained in For the training data set The The predicted probability vector of samples, is the maximum value function, For the training data set The The maximum predicted probability of samples, Represents a clean dataset The samples, For clean dataset The The samples belong to The predicted probability value of each category, For the training data set The The predicted probability vector of samples, For clean dataset The The maximum predicted probability of a sample.

3. The backdoor poisoning defense method for intelligent identification of communication signals according to claim 2 is characterized in that: The maximum prediction probability for the training dataset and the maximum prediction probability for the clean dataset are divided into categories respectively. The high prediction probability ratio of each category in the training dataset and the clean dataset is calculated based on the preset high prediction probability threshold, which is achieved by the following formula: ； ； in, Represents the training dataset The one in Category samples, is the preset high prediction probability threshold, Represents the training dataset The one in Category The maximum predicted probability of samples, Represents the training dataset The one in The total number of samples in each category, Represents the training dataset The The proportion of high prediction probabilities of each category, Represents a clean dataset The one in Category samples, Represents a clean dataset The one in Category The maximum predicted probability of samples, Represents a clean dataset The The proportion of high prediction probabilities of each category, is the counting function.

4. A backdoor poisoning defense method for intelligent identification of communication signals according to claim 3, characterized in that: Compare the proportion of high predicted probabilities of the same category in the training dataset and the clean dataset to determine the category of the poisoned sample, including: Traverse each category and calculate the first difference between the proportion of high prediction probabilities of the training dataset and the clean dataset under the current category; If the absolute value of the first difference is greater than a first preset threshold, and the proportion of high prediction probabilities in the training dataset is greater than the proportion of high prediction probabilities in the clean dataset, then the current category is determined to be the category of the poisoned sample; If the absolute value of the first difference is greater than a first preset threshold, and the high prediction probability ratio of the training data set is less than the high prediction probability ratio of the clean data set, it is determined that the training data set is incorrect; If the absolute value of the first difference is less than or equal to the first preset threshold, the first difference between the high prediction probability proportions of the training data set and the clean data set under the next category is calculated.

5. The backdoor poisoning defense method for intelligent identification of communication signals according to claim 1 is characterized in that: Use the K-means clustering algorithm to perform binary clustering on all samples in the same category as the poisoned sample, calculate the proportion of high prediction probabilities in each of the two sample clusters, and determine the poisoned sample cluster, including: Randomly determine 2 initial points and As the centroid, calculate the distance between each poisoned sample in the poisoned sample cluster and each centroid, and assign each poisoned sample to the sample cluster represented by the nearest centroid, and obtain two sample clusters in total; Update the centroid of each sample cluster to the average value of all its samples, repeat the sample cluster assignment and the update of the sample cluster centroid until the sample cluster centroid no longer changes significantly or reaches the preset maximum number of updates, and finally obtain the two sample clusters; Calculate the high prediction probability ratios of the final two sample clusters respectively and compare them, and determine the sample cluster with a higher high prediction probability ratio as the poisoning sample cluster; The poisoned sample cluster is represented by the following formula: ； in, Indicates the Poisoned samples, Represents the set of all samples in the category of the poisoned sample, Indicates the attack category specified by the attacker. Indicates a cluster of poisoned samples.

6. A backdoor poisoning defense system for intelligent identification of communication signals, characterized in that: The system comprises: A recognition network prediction module is used to input the training data set and the clean data set into the recognition network respectively, and obtain the maximum prediction probability of the recognition network for the training data set and the maximum prediction probability for the clean data set, wherein the recognition network is obtained by iterative training based on the training data set; The poisoned sample location module is used to divide the maximum prediction probability of the training dataset and the maximum prediction probability of the clean dataset into categories, calculate the high prediction probability ratio of each category in the training dataset and the clean dataset based on the preset high prediction probability threshold, compare the high prediction probability ratio of the same category in the training dataset and the clean dataset, and determine the category of the poisoned sample; The poisoned sample separation module is used to perform binary clustering on all samples in the poisoned sample category using the K-means clustering algorithm, calculate the proportion of high prediction probabilities in each of the two sample clusters, and determine the poisoned sample cluster; The anti-learning training module is used to train the recognition network based on the poisoned sample cluster, destroying the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample, thus realizing the backdoor poisoning defense of the recognition network; In the process of training the recognition network based on anti-learning of poisoned sample clusters, destroying the strong association between the backdoor trigger of the recognition network and the attacker's specified category and poisoned samples, and realizing the backdoor poisoning defense of the recognition network, the anti-learning training loss function used is expressed by the following formula: ； in, Indicates the number of clean samples and separated poisoned samples in the current training batch, Indicates the The real label The value at the position, The first tag on the attack category specified by the attacker The value at the position, Represents the recognition network for the The clean sample belongs to The predicted probability of each category, Represents the recognition network for the The poisoned sample belongs to The predicted probability of each category, represents the number of iterations, Represents the total number of layers of the recognition network, Indicates the The first iteration of the identification network The network parameter vector of the layer, Indicates the initial recognition network The network parameter vector of the layer, Indicates taking the L1 norm, and is the preset weight coefficient, Indicates the Anti-learning training loss function at iterations; In the process of training the recognition network based on the poisoned sample cluster, the backdoor trigger of the recognition network and the strong association between the attacker's specified category and the poisoned sample are destroyed to achieve the backdoor poisoning defense of the recognition network. Based on the anti-learning training loss function, the anti-learning final loss function is obtained, and the recognition network is trained using the anti-learning final loss function. The final loss function of anti-learning is expressed by the following formula: ； in, is a symbolic function, is the preset loss threshold, Indicates the The final loss function of the anti-learning at the iteration.

7. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a backdoor poisoning defense method for intelligent identification of communication signals as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement a backdoor poisoning defense method for intelligent identification of communication signals as described in any one of claims 1 to 5.

Images