A backdoor attack defense method for deep learning models based on decoupled learning process

Abstract

The present invention provides a deep learning model backdoor attack defense method based on a decoupled learning process, which belongs to the field of artificial intelligence and deep learning, including: using a tampered data set to perform supervised learning training on the deep learning model in a manner of minimizing a first loss function; respectively calculating the predicted entropy of each clean sample and poisoned sample, filtering the predicted entropy to obtain a clean subset; using the clean subset to perform active forgetting training on the deep learning model after supervised learning training in a manner of maximizing a second loss function; deleting the labels of samples other than the clean subset in the data set to obtain an unlabeled data set, merging the unlabeled data set with the clean subset to form a semi-supervised data set, and using the semi-supervised data set to perform semi-supervised fine-tuning training on the deep learning model after active forgetting training. The present invention has strong robustness, low cost, and significant defense effect.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence and deep learning, and specifically relates to a deep learning model backdoor attack defense method based on a decoupled learning process. Background Art

[0002] With the widespread application of deep learning technology, its security issues have also received increasing attention, especially the threat of backdoor attacks. Backdoor attacks use carefully designed malicious samples or modify model parameters to make the model perform the attacker's preset incorrect behavior when receiving specific inputs, while performing normally under regular inputs, such as Figure 1 This attack method poses a serious security risk to various applications that rely on deep learning models. Since deep learning models rely on the quality and integrity of training data, any contaminated data may become an entry point for attackers. Once the model is implanted with a backdoor, it may make wrong judgments in critical tasks (such as financial risk assessment, security monitoring, etc.), causing serious consequences.

[0003] When designing and training traditional deep learning models, they often focus more on improving the prediction accuracy and generalization ability of the model, but not enough on the security of the model. Existing backdoor attack defense methods are mostly concentrated in the theoretical research and experimental verification stages. Their defense effects on complex scenarios and variable attack methods in actual deployment need to be further verified.

[0004] To mitigate the backdoor threat, the existing defense methods can be divided into two categories: empirical backdoor defense and authenticated backdoor defense. Empirical backdoor defense is proposed based on some observations or understanding of existing attacks and has good performance in practice. For example, Bolun et al. proposed a set of systematic detection and mitigation techniques to deal with backdoor attacks in deep neural networks (DNNs). However, the unexplainability of DNNs is still a potential disadvantage of its defense technology, which needs to be overcome by future research.

[0005] Soheil et al. proposed a new method based on unified learning principles (ULPs) to detect backdoor attacks in convolutional neural networks (CNNs). Although this method is effective, it has problems such as high training cost, limited trigger types, and model versatility. Yige et al. proposed an adaptive Bayesian learning (ABL) method, which provides a new technical path for backdoor defense, but the robustness of this method to more complex and more hidden backdoor attacks has not been deeply explored.

[0006] In contrast, authenticated backdoor defense can provide provable or verifiable robustness guarantees to prevent deep learning models from backdoor attacks. For example, Binghui et al. explored the use of random smoothing techniques to authenticate robustness against backdoor attacks in deep learning models, but existing random smoothing methods have limited effectiveness in defending against backdoor attacks. Maurice et al. proposed to provide provable robustness for deep learning models through random smoothing techniques, especially defense against backdoor attacks. Despite the theoretical framework and experimental evaluation, these defenses may face high computational costs and scalability issues in practical applications. Chulin et al. proposed the CRFL framework, which provides an authenticated robustness solution for backdoor attacks in federated learning and demonstrated its effectiveness through theoretical analysis and experimental verification. However, the framework also has potential disadvantages such as computational cost, noise impact, authentication boundaries, and parameter dependence.

[0007] Based on the above analysis, research on backdoor attack defense for deep learning models is particularly important. This requires not only starting from the data and model levels to identify and remove malicious samples in training data, but also designing a robust model structure and training strategy to resist potential attacks. Summary of the invention

[0008] The purpose of this invention is to propose a deep learning model backdoor attack defense method based on a decoupled learning process, which has strong robustness, low cost and significant defense effect.

[0009] The present invention is achieved through the following technical solutions:

[0010] A deep learning model backdoor attack defense method based on a decoupled learning process includes the following steps:

[0011] Step S1: using the tampered data set to perform supervised learning training on the deep learning model in a manner of minimizing a first loss function, the tampered data set includes a clean sample and a poisoned sample;

[0012] Step S2: According to the prediction results of the deep learning model for clean samples and poisoned samples, the predicted entropy of each clean sample and poisoned sample is calculated respectively, all the predicted entropies are sorted and filtered at a set filtering rate to obtain a clean subset and a poisoned subset;

[0013] Step S3, using the clean subset formed in step S2, actively forget training is performed on the deep learning model trained in step S1 in a manner of maximizing the second loss function, so that the model forgets the normal behavior characteristics learned on the clean samples, thereby exposing neurons related to the backdoor task;

[0014] Step S4, delete the labels of samples in the data set except the clean subset to obtain an unlabeled data set, merge the unlabeled data set with the clean subset to form a semi-supervised data set, and use the semi-supervised data set to perform semi-supervised fine-tuning training on the deep learning model trained in step S3 to restore the forgotten normal behavior features. During the fine-tuning process, a filter-level recovery strategy is adopted.

[0015] The deep learning model backdoor attack defense method based on the decoupled learning process according to claim 1 is characterized in that: in the step S1, the first loss function is expressed as , where D p Represented by the clean sample x p The clean sample set formed, D c Represents the poisoned sample x c The poisoned sample set formed, m represents the number of clean samples, n represents the total number of clean samples and poisoned samples, L1(.) represents the cross entropy loss function, f w (.) is the backdoor model in the deep learning model, w is the backdoor model parameter, y p Represents the clean sample x p The target class, y c Indicates the poisoned sample x c Target class.

[0016] Furthermore, the poisoned sample is obtained by injecting a clean sample into a trigger.

[0017] Furthermore, in step S2, all n predicted entropies are sorted in ascending order, and the filtering rate is set , put the front The samples corresponding to the predicted entropy are filtered out and form the poisoned subset , after The samples corresponding to the predicted entropy are filtered out and form a clean subset , wherein the sample includes the clean sample and / or the poisoned sample in step S1.

[0018] Furthermore, in step S3, the second loss function is expressed as , where m' represents the clean subset The number of samples in Represents a clean subset The samples in Representation sample The corresponding target class, Represents the weight of the deep learning model after training in step S1.

[0019] Furthermore, in step S4, according to the formula Get the dataset Remove the clean subset Subsets other than , subset The labels of the samples in are deleted to obtain an unlabeled dataset , according to the formula Get a semi-supervised dataset .

[0020] Furthermore, in step S4, the deep learning model is semi-supervised fine-tuned using a third loss function, and the third loss function is expressed as ,in, , represents the weight of the deep learning model after training in step S3, represents the randomly initialized weights of the deep learning model, Indicates that the weights are initialized randomly Updated deep learning model parameters, N represents the semi-supervised dataset The number of samples, L2(.) represents the semi-supervised loss function, is the regularized loss function, Represents an unlabeled dataset The samples in Represents a semi-supervised dataset The samples in and is the weight coefficient.

[0021] Furthermore, in step S4, the semi-supervised loss function is expressed as , where r represents the unlabeled dataset The number of samples in , , and Respectively represent the data sets Perform strong and weak enhancement.

[0022] The present invention has the following beneficial effects:

[0023] 1. The present invention first uses the tampered data set to perform supervised learning training on the deep learning model in a manner of minimizing the first loss function. Then, according to the prediction results of the deep learning model for clean samples and poisoned samples, the predicted entropy of each clean sample and poisoned sample is calculated respectively. All the predicted entropies are sorted and filtered at a set filtering rate to obtain a clean subset and a poisoned subset. Then, the clean subset is used to perform active forgetting training on the deep learning model after supervised learning training in a manner of maximizing the second loss function, so that the model forgets the normal behavior features learned on the clean samples, thereby exposing neurons related to the backdoor task. Finally, the labels of the samples other than the clean subset in the data set are deleted to obtain an unlabeled data set, and the unlabeled data set is combined with the clean subset to form a semi-supervised data set. The semi-supervised data set is used to perform semi-supervised fine-tuning training on the deep learning model after active forgetting training to restore the forgotten normal behavior features, that is, the standard training learning process is decoupled into supervised learning, active forgetting and semi-supervised fine-tuning stages. This decoupling strategy helps to extract benign models from potentially contaminated data sets while maintaining the effectiveness and availability of the models, thereby achieving low-cost and robust effective defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention is further described in detail below with reference to the accompanying drawings.

[0025] Figure 1 This is a schematic diagram of a backdoor attack.

[0026] Figure 2 It is a flow chart of the present invention.

[0027] Figure 3 It is a specific schematic diagram of the present invention.

[0028] Figure 4 It is a simulation diagram of the training accuracy of the clean subset and the poisoned subset of the present invention. DETAILED DESCRIPTION

[0029] For a standard deep learning model of backdoor attack, where the attacker controls the dataset, the user trains a deep learning model on an unreliable dataset (specifically provided by the attacker). When presented with a sample containing a trigger, this deep learning model will exhibit targeted misclassification after training. The attacker's goal is to provide a tampered dataset from which the model trained will be passively implanted with a backdoor. In this work, we assume that the attacker has the most power. With full access to the training dataset, the attacker can use any state-of-the-art backdoor attack strategy to inject the trigger into the dataset. While the defender aims to train a benign model from the tampered dataset.

[0030] like Figure 1The backdoor attack diagram shown in Figure 1 introduces a typical backdoor attack, which is a more efficient single-target attack (also called a many-to-one attack). In a single-target attack, any input with a trigger is recognized by the deep learning model as the same label, that is, the target label is unique.

[0031] Given the original training dataset , poisoning rate α, target class y t , the original training data set Can be divided into target subsets and the clean subset ,in The attacker will inject triggers into From all samples, we get the poisoned subset ,in , ⊗ refers to the injection method, ∆ refers to the trigger, and this process is the dataset poisoning process. Then, the attacker releases the tampered dataset .

[0032] Once the user uses the dataset After training the deep learning model, the backdoor will be implanted in the deep learning model. During the testing phase, the deep learning model will run normally on clean samples while predicting the poisoned samples as the target category: , where f w (.) A deep learning model with a backdoor, w is the weight of the deep learning model, y is i For x i The true value label of A sample with a trigger injected.

[0033] The above is the entire process of the backdoor attack. The defender's goal is to use the data set Training a good model , regardless of whether the sample has a triggering factor, the benign model can give consistent predictions: .

[0034] like Figure 2 and Figure 3 The deep learning model backdoor attack defense method based on the decoupled learning process shown is used to achieve the above defense goals, including the following steps:

[0035] Step S1: using the tampered data set to perform supervised learning training on the deep learning model in a manner of minimizing a first loss function, the tampered data set includes a clean sample and a poisoned sample;

[0036] This step is the supervised training phase. In the early stages of standard learning, deep learning models tend to learn both the backdoor task on poisoned samples and the main task on clean samples when trained on the tampered dataset. We observe that the performance of deep learning models in learning the backdoor task in this phase is often better than that of learning the main task. Based on this observation, we decouple the standard learning process and set the first phase as supervised learning, which is achieved by performing an initial standard training on the entire tampered dataset. At the end of this phase, the deep learning model will over-learn the backdoor task but will not fully learn the main task. Through this differential behavior, the deep learning model can filter out poisoned samples and identify clean samples with a high degree of confidence.

[0037] Deep learning models on tampered datasets The standard learning procedure is , where L1(.) represents the supervised learning loss function (such as the cross entropy loss function), and w is the weight of the deep learning model. This formula can be implemented by propagating the direction of stochastic gradient descent. Dataset The training process on the clean sample set D p and poisoned sample set D c Training, that is, training with the following first loss function: , where D p Represented by the clean sample x p The clean sample set formed, D c Represents the poisoned sample x c The poisoned sample set formed, m represents the number of clean samples, n represents the total number of clean samples and poisoned samples, L1(.) represents the cross entropy loss function, f w (.) is a deep learning model with a backdoor, w is the weight of the deep learning model, and y p Represents the clean sample x p The target class, y c Indicates the poisoned sample x c Target class.

[0038] In this embodiment, representative backdoor attacks BadNets and SIG are used to train on the CIFAR-10 dataset. These two attacks are typical strategies of poisoned label attack and clean label attack. The poisoning rate α is set to 10% and the batch size is set to 16. Figure 4The changes in training accuracy of poisoned and clean samples during backdoor learning are shown. In the early stages of training, poisoned samples show higher accuracy than clean samples. This phenomenon suggests that the deep learning model learns the backdoor task faster than the main task. To master the backdoor task, the deep learning model only needs to learn the mapping from triggers to target classes. To improve the effectiveness of backdoor attacks, attackers tend to design triggers into patterns that are easy to learn, such as fixed simple images or optimized sets of pixels. Therefore, the backdoor task can be learned faster when both tasks are learned simultaneously. The predictions of the deep learning model on the samples will reflect the differences in the above learning behaviors. The deep learning model can predict the poisoned samples more confidently, while the confidence level of the clean samples is lower. Through this differential behavior, the deep learning model can filter out the poisoned samples and clean the samples with a high degree of confidence.

[0039] Step S2: According to the prediction results of the deep learning model for clean samples and poisoned samples, the predicted entropy of each clean sample and poisoned sample is calculated respectively, all the predicted entropies are sorted and filtered at a set filtering rate to obtain a clean subset and a poisoned subset;

[0040] Shannon entropy is used to represent the difficulty of prediction. The deep learning model cannot learn the main task well, so the prediction of clean samples is uncertain. Therefore, in the corresponding prediction results, the probability of belonging to each class is almost the same, resulting in a higher entropy value. In contrast, the entropy value of poisoned samples is lower because they are easy to predict. The entropy of sample x can be expressed as , where y i is the probability that sample x belongs to class i, and C is the total number of classes.

[0041] Sort all n predicted entropies in ascending order and set the filtering rate The filtration rate is determined based on experience, experimental objectives and requirements. The samples corresponding to the predicted entropy are filtered out and form the poisoned subset , after The samples corresponding to the predicted entropy are filtered out and form a clean subset , where the samples include the clean samples and / or poisoned samples in step S1. This is consistent with the diversity principle of active learning and the requirements of semi-supervised learning.

[0042] Step S3, using the clean subset formed in step S2, actively forget training is performed on the deep learning model trained in step S1 in a manner of maximizing the second loss function, so that the model forgets the normal behavior characteristics learned on the clean samples, thereby exposing neurons related to the backdoor task;

[0043] This step is an active forgetting step. The purpose of this step is to expose neurons affected by the backdoor attack. Therefore, the clean subset is used for training, aiming to cancel the neurons in the deep learning model by maximizing the model error on the clean sample. This process is designed to make the deep learning model forget the feature representation of the clean sample, thereby exposing the clean neurons associated with the clean features, and retaining only the neurons related to the backdoor task as much as possible, so that the performance of the deep learning model on the clean data is close to random guessing, which is convenient for subsequent operations. Since defenders usually do not have access to the poisoned data, they cannot perform such operations on the poisoned data. In summary, the reason for using the clean subset instead of the poisoned subset is that the method is designed to make the model actively forget the normal behavior it has learned from the clean sample, rather than the abnormal behavior on the poisoned sample, so as to expose and retain the neurons related to the backdoor attack. When the performance of the model on the clean data is close to random guessing, it can be considered that the backdoor feature has been effectively exposed.

[0044] Finding the backdoor in the learning model is equivalent to making the deep learning model forget the main task. Learning and forgetting are mutually opposing processes, so we can maximize the The loss function on forgets the backdoor feature, that is, the second loss function is expressed as , where m' represents the clean subset The number of samples in Represents a clean subset The samples in Representation sample The corresponding target class, Represents the weight of the deep learning model after training in step S1.

[0045] If the above maximization is applied to the entire clean data , clean neurons can be effectively forgotten, but in experiments it is found that good forgetting effects can be achieved with only a small number of clean samples.

[0046] Step S4, delete the labels of samples in the data set except the clean subset to obtain an unlabeled data set, merge the unlabeled data set with the clean subset to form a semi-supervised data set, and use the semi-supervised data set to perform semi-supervised fine-tuning training on the deep learning model trained in step S3 to restore the forgotten normal behavior features. During the fine-tuning process, a filter-level recovery strategy is adopted.

[0047] This step is the active semi-supervised fine-tuning stage. After supervised training, the deep learning model has not fully learned the main task. The active forgetting process will slightly forget the clean features and further reduce the performance of the deep learning model on the main task. For these two reasons, this step is set to improve the performance of the deep learning model.

[0048] According to the formula Get the dataset Remove the clean subset Subsets other than , subset The labels of the samples in are deleted to obtain an unlabeled dataset , according to the formula Get a semi-supervised dataset .

[0049] Using the third loss function to test the deep learning model on the semi-supervised dataset Semi-supervised fine-tuning training is performed on the deep learning model to restore the features of the clean samples deleted by the previous forgetting step. By updating the deep learning model after forgetting, it can be effectively restored to minimize its classification loss on clean data. This process is similar to model training. In this embodiment, recovery is performed on filters instead of neurons, and the filter mask is used to locate potential backdoor filters (and their associated neurons), which is filter recovery. Because if the recovery process is also applied to neurons, it may become a direct reversal of forgetting, and ultimately restore the forgotten clean neurons to their original values, which does not help expose the backdoor neurons. This is why we apply recovery to filters instead of neurons. Filter-level recovery limits the freedom of recovery to a coarser granularity, forcing the model to reuse dormant backdoor neurons to compensate for the loss of clean features. In this process, clean neurons are also relearned to restore the main task function.

[0050] Formally speaking, semi-supervised fine-tuning training solves the optimization problem , the third loss function is expressed as ,in, represents the weight of the deep learning model after training in step S3, represents the randomly initialized weights of the deep learning model, Indicates that the weights are initialized randomly Updated deep learning model parameters, N represents the semi-supervised dataset The number of samples, L2(.) represents the semi-supervised loss function, is the regularized loss function, Represents an unlabeled dataset The samples in Represents a semi-supervised dataset The samples in and is the weight coefficient.

[0051] For normal labeled data, conventional cross entropy is used to calculate the loss, such as As shown in the figure, for unlabeled data, weak augmentation and strong augmentation are used to generate new data. Weak augmentation refers to the use of standard flipping and translation strategies, and strong augmentation refers to the use of RandAugment or CTAugment first, and then CutOut enhancement for data with severe output distortion.

[0052] The new samples obtained by using different data enhancements are input into the deep learning model for prediction, which can enhance the robustness of the model. For weakly enhanced samples, we tend to believe that the deep learning model has a higher confidence in its prediction, so we use argmax to obtain pseudo labels for the weakly enhanced predictions; then the cross entropy loss is calculated for the strongly enhanced predictions and the pseudo labels obtained by the weak enhancements, so as to achieve the purpose of consistency regularization, that is, the semi-supervised loss function L2 is expressed as , where r represents the unlabeled dataset The number of samples in , , and Respectively represent the data sets Perform strong and weak enhancement.

[0053] This step uses filter-level recovery rather than neuron-level recovery, making forgetting and recovery an asymmetric process. This asymmetry prevents the deep learning model from simply restoring the forgotten clean features to their original state, but instead forces the deep learning model to reuse neurons that may be related to the backdoor to compensate for the loss of clean features. In this way, the deep learning model will not re-implant the backdoor while restoring the clean features, thereby effectively resisting the impact of backdoor attacks. Ultimately, the deep learning model gradually recovers the ability to recognize normal samples while maintaining its defense against backdoor attacks, further enhancing the usability and security of the deep learning model.

[0054] The reasons why semi-supervised learning will not re-implant backdoors in deep learning models include: first, unlabeled data will be executed on strong data augmentation, which will eventually render the trigger ineffective; second, the poisoned samples lack labels, so the model cannot learn the association between triggers and target labels; finally, the use of filter-level recovery instead of neuron-level recovery makes forgetting and recovery an asymmetric process, further avoiding the possibility of re-implanting backdoors.

[0055] During the recovery process, All elements in are initialized to 1 and clipped to the range [0,1]. After recovery, The low values ​​close to zero in indicate that the filter (and its associated neurons) contain a large portion of repurposed neurons that are likely to be associated with the backdoor. Therefore, these neurons can be pruned to purify the backdoor model. Experiments show that in the recovered model, the activations associated with the trigger are greatly reduced, while the activations of the clean features are significantly enhanced.

[0056] The above description is only a preferred embodiment of the present invention, and therefore cannot be used to limit the scope of implementation of the present invention. That is, equivalent changes and modifications made according to the scope of the patent application of the present invention and the contents of the specification should still fall within the scope covered by the patent of the present invention.

Claims

1. A deep learning model backdoor attack defense method based on a decoupled learning process, characterized by: The steps include: Step S1: using the tampered data set to perform supervised learning training on the deep learning model in a manner of minimizing a first loss function, the tampered data set includes a clean sample and a poisoned sample; Step S2: According to the prediction results of the deep learning model for clean samples and poisoned samples, the predicted entropy of each clean sample and poisoned sample is calculated respectively, all the predicted entropies are sorted and filtered at a set filtering rate to obtain a clean subset and a poisoned subset; Step S3, using the clean subset formed in step S2, actively forget training is performed on the deep learning model trained in step S1 in a manner of maximizing the second loss function, so that the model forgets the normal behavior characteristics learned on the clean samples, thereby exposing neurons related to the backdoor task; Step S4, deleting the labels of samples except the clean subset in the data set to obtain an unlabeled data set, merging the unlabeled data set with the clean subset to form a semi-supervised data set, and using the semi-supervised data set to perform semi-supervised fine-tuning training on the deep learning model trained in step S3 to restore the forgotten normal behavior features. During the fine-tuning process, a filter-level recovery strategy is adopted; In step S1, the first loss function is expressed as , where D p Represented by the clean sample x p The clean sample set formed, D c Represents the poisoned sample x c The poisoned sample set formed, m represents the number of clean samples, n represents the total number of clean samples and poisoned samples, L1(.) represents the cross entropy loss function, f w (.) is the backdoor model in the deep learning model, w is the backdoor model parameter, y p Represents the clean sample x p The target class, y c Indicates the poisoned sample x c Target class; The poisoned sample is obtained by injecting a clean sample into a trigger; In step S2, all n predicted entropies are sorted in ascending order, and the filtering rate is set , put the front The samples corresponding to the predicted entropy are filtered out and form the poisoned subset , after The samples corresponding to the predicted entropy are filtered out and form a clean subset , wherein the sample includes the clean sample and / or the poisoned sample in step S1; In step S3, the second loss function is expressed as , where m' represents the clean subset The number of samples in Represents a clean subset The samples in Representation sample The corresponding target class, Represents the weight of the deep learning model after training in step S1.

2. According to claim 1, a deep learning model backdoor attack defense method based on a decoupled learning process is characterized in that: In step S4, according to the formula Get the dataset Remove the clean subset Subsets other than , subset The labels of the samples in are deleted to obtain an unlabeled dataset , according to the formula Get a semi-supervised dataset .

3. According to claim 2, a deep learning model backdoor attack defense method based on a decoupled learning process is characterized in that: In step S4, the deep learning model is semi-supervised fine-tuned using a third loss function, where the third loss function is expressed as ,in, , represents the weight of the deep learning model after training in step S3, represents the randomly initialized weights of the deep learning model, Indicates that the weights are initialized randomly Updated deep learning model parameters, N represents the semi-supervised dataset The number of samples, L2(.) represents the semi-supervised loss function, is the regularized loss function, Represents an unlabeled dataset The samples in Represents a semi-supervised dataset The samples in and is the weight coefficient.

4. The deep learning model backdoor attack defense method based on the decoupled learning process according to claim 3 is characterized by: In step S4, the semi-supervised loss function is expressed as , where r represents the unlabeled dataset The number of samples in , , and Respectively represent the data sets Perform strong and weak enhancement.

Images