Defense method and system for model backdoor attack

Abstract

The invention belongs to the technical field of artificial intelligence security, and relates to a defense method for model backdoor attacks. The invention aims to solve the problem that the accuracy of the model is remarkably reduced due to the existing defense technology. The method combines a backdoor label detection method and a model fine tuning method, and is realized by the following steps of: firstly, detecting a backdoor label by utilizing a nerve cleaning method, and identifying a potential backdoor trigger; secondly, generating an adversarial sample by using a projection gradient descent algorithm; then, carrying out first-stage adversarial fine tuning training to reduce the sensitivity of the model to a backdoor trigger; and finally, performing second-stage fine tuning training through the clean sample, and gradually recovering the classification performance of the model on the original data.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology and relates to a defense method and system against model backdoor attacks. Background Art

[0002] With the development of deep learning technology, deep neural networks have made significant progress in many fields such as image recognition, natural language processing and autonomous driving. Since AlexNet performed well in the ImageNet Challenge in 2012, deep learning technology has quickly attracted widespread attention. However, although deep neural networks perform well in solving complex tasks, their unexplainability and low transparency also bring security risks. Research in recent years has shown that deep learning models are vulnerable to backdoor attacks, which poses a great risk to safety-critical applications such as autonomous driving and face recognition.

[0003] Backdoor attacks are an attack method that implants hidden backdoor triggers during the training process of deep learning models. The attacker injects malicious samples into the training data. When the model is fed with attack samples carrying backdoor triggers, it will produce erroneous outputs, while the model behaves normally without the backdoor triggers. The concealment of this attack makes the model difficult to detect in normal use scenarios, increasing the complexity of detection and defense.

[0004] There are two main ways to implement backdoor attacks: poison label attacks and clean label attacks. Poison label attacks require modifying both the features and labels of training samples, so that samples with backdoor triggers are misclassified as the target category specified by the attacker. This method is relatively direct, but it is easy to detect through anomaly detection technology. Clean label attacks are more covert, and attackers only modify the features of samples without changing their labels, which increases the difficulty of attack detection. Existing research shows that attackers can effectively implement clean label backdoor attacks through adversarial perturbations, image scaling, or embedded textures.

[0005] Existing defense methods mainly focus on the data level and the model level. Data-level defense methods usually detect the characteristics of input data to identify potential malicious samples. However, as the concealment of attack methods increases, existing methods are difficult to effectively detect cleverly designed backdoor attacks. Model-level defense methods attempt to mitigate the attack effect by removing or suppressing the abnormal behavior of backdoor neurons. Such methods can achieve good defense effects in some cases, but are often accompanied by a decrease in model performance, especially when the model structure is complex or the attack method is complex. There is a trade-off between defense effect and model performance. Summary of the invention

[0006] The purpose of the present invention is to provide a defense method against model backdoor attacks, so as to solve the problem that the existing defense methods are often accompanied by a significant decrease in model classification performance when dealing with backdoor attacks in deep neural networks, which limits the existing methods in practical applications.

[0007] To achieve the above object, the present invention adopts the following technical solution to achieve the above object: a defense method against model backdoor attack, comprising the following steps:

[0008] A neural cleaning backdoor detection method is used to obtain a backdoor label, which is used to guide the generation of adversarial samples;

[0009] Generate adversarial samples using the projected gradient descent adversarial attack algorithm;

[0010] Use the generated adversarial examples to perform the first stage of fine-tuning training;

[0011] The second stage of fine-tuning training is performed using normal clean samples to restore the classification performance of the model on the original data.

[0012] In some embodiments, the neural cleaning backdoor detection method is used to obtain the backdoor label specifically as follows: the neural cleaning method is used to analyze the input and output of the model, and then the backdoor trigger is reversed, and then the L1 mask norm value corresponding to the backdoor trigger is analyzed and compared to determine the backdoor label.

[0013] In some embodiments, the formula for reversing the backdoor trigger is:

[0014] δ=argmin δ ||f(x+δ)-y target || (1)

[0015] Where f is the model, x is the input sample, y is the output prediction, δ is the backdoor trigger, and y traget is the backdoor label, argmin δ represents the minimum perturbation required to make the model predict the backdoor label.

[0016] In some embodiments, the formula for the adversarial sample generated by the projected gradient descent algorithm can be expressed as:

[0017]

[0018] in, is the loss function, B ∈ (x) is the neighborhood with x as the center and radius ∈, x adv is the generated adversarial sample, y clean is the original label of the sample.

[0019] In some embodiments, the first stage of fine-tuning training is specifically: using the generated adversarial sample set, using a dynamic learning rate and a set number of fine-tuning rounds for training, and the specific optimization target formula is:

[0020]

[0021] Among them, x adv represents the adversarial sample, y target Indicates the backdoor tag, represents the loss function, which measures the model f θ In predicting input x adv With label y target The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

[0022] In some embodiments, the clean samples are subjected to the second stage of fine-tuning training, using (x clean ,y clean ) for fine-tuning, the specific optimization target formula is:

[0023]

[0024] where x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ In predicting input x clean With label y clean The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

[0025] In some embodiments, a comprehensive optimization target is also included, and the comprehensive optimization target can be expressed as:

[0026]

[0027] where x adv represents the adversarial sample, y target Indicates the backdoor tag, x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ The difference between the predicted input x and the label y. λ is a hyperparameter used to balance the model performance and the ability to resist backdoor attacks.

[0028] The present invention also provides a defense system against model backdoor attacks, comprising:

[0029] A backdoor label detection module, used to obtain a backdoor label using a neural cleaning backdoor detection method, wherein the backdoor label is used to guide the generation of adversarial samples;

[0030] Adversarial sample generation module, used to generate adversarial samples using the projected gradient descent adversarial attack algorithm;

[0031] The first-stage fine-tuning module is used to perform the first-stage fine-tuning training using the generated adversarial samples;

[0032] The second-stage fine-tuning module is used to perform the second-stage fine-tuning training using normal clean samples to restore the classification performance of the model on the original data.

[0033] The beneficial effect of the present invention is that the success rate of backdoor attacks is significantly reduced, and the classification accuracy of the model is effectively maintained, and even improved compared with the original backdoor model, achieving the effect of balancing model security and model performance. The method of the present invention does not rely on a significant modification of the model architecture, nor does it require retraining the entire model, so it has high practicality. By making lightweight adjustments to the existing model, the purpose of defending against backdoor attacks can be achieved, reducing the implementation cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a framework diagram of the defense method of the present invention;

[0035] Figure 2 is the index graph of the adversarial fine-tuning model in the first stage of the present invention;

[0036] Figure 3 It is the indicator graph of the traditional fine-tuning model;

[0037] Figure 4 It is the index diagram of the second stage restorative fine-tuning model of the present invention; DETAILED DESCRIPTION

[0038] In order to facilitate the understanding and implementation of the present invention by those skilled in the art, the present invention is further illustrated and described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0039] Simulation conditions: The present invention conducted experiments using the deep learning framework Pytorch2.4 on a 12th Gen Intel(R) Core(TM) i7-12700F CPU, 32GB RAM, NVIDIA GeForce RTX 3060, and Windows 11 operating system.

[0040] The specific implementation steps and detailed parameter settings are as follows:

[0041] S1. Dataset preparation: The CIFAR-10 dataset is used, which contains 60,000 32×32 pixel color images. According to the official classification, the dataset consists of 50,000 training images and 10,000 test images, and these 60,000 images are evenly distributed in 10 categories (labels are 0 to 9).

[0042] S2. Backdoor attack injection: In the BadNets attack, select the 3×3 pixel white square in the lower right corner as the backdoor trigger. Randomly select 2% of the images (about 1,000) from the training set. Change the labels of these images to the backdoor label "1". Add a white square backdoor trigger in the lower right corner of these images. In the Blended attack, use a mixed image as the backdoor trigger. Also randomly select 2% of the images in the training set. Use one image to blend with the source image, and the blending strength is set to 0.1.

[0043] S3. Backdoor detection and reverse calculation of backdoor triggers: In backdoor attack defense, in order to generate adversarial samples, a backdoor label needs to be determined. The present invention adopts the neural cleanse (NC) backdoor detection method to obtain the backdoor label. The NC method analyzes the output of the model to find potential backdoor triggers and determine the backdoor label that is most vulnerable to attack. This backdoor label is used to guide the generation of adversarial samples so that the generated samples have a clear attack direction.

[0044] Assume that model f accepts input x and outputs prediction y. Use the NC method to reversely calculate the backdoor trigger δ and the backdoor label y traget The goal is to identify possible backdoor triggers by minimizing the model's sensitivity to specific inputs. This process can be expressed as:

[0045] δ=argmin δ ||f(x+δ)-y target || (1)

[0046] Where f is the model, x is the input sample, y is the output prediction, δ is the backdoor trigger and y traget is the backdoor label, argmin δ represents the minimum perturbation required to make the model predict the backdoor label.

[0047] In this experiment, in order to detect the injected backdoor, the NC method is used to reversely calculate the backdoor trigger, and 100 iterations are performed to improve the detection accuracy. Then, the L1 mask norm analysis is used to identify the backdoor label.

[0048] S4. Adversarial sample generation: For the detected backdoor labels, the projected gradient descent (PGD) adversarial attack algorithm is used to generate adversarial samples. The PGD adversarial attack algorithm is a common adversarial attack method in the field of computer vision. Its purpose is to find adversarial samples that can mislead the model through iterative optimization. After iterative calculation, a batch of adversarial samples can be generated, so that the model's prediction results for these adversarial samples are the backdoor labels pre-set by the attacker. This batch of adversarial samples has the characteristics of the target attack label (for example, backdoor triggering samples), and the PGD adversarial attack algorithm is used to generate adversarial samples.

[0049] PGD ​​finds the adversarial sample formula that maximizes the loss function through iterative optimization as follows:

[0050]

[0051] in, is the loss function, B ∈ (x) is a neighborhood with x as the center and radius ∈. The generated adversarial sample x adv With the original label y clean , used for fine-tuning training, To maximize the loss value in a limited area, f(x′) is the gradient of the model on the current input sample.

[0052] In the experiment, 40 iterations were performed in the process of generating adversarial samples. The step size of each iteration was set to 0.01 and the maximum perturbation range was set to 8 / 255.

[0053] S5. One-stage adversarial sample purification: In order to reduce the sensitivity of the model to backdoor triggers and reduce the success rate of attacks, the first fine-tuning training is performed to calculate the loss and update the model parameters for each generated adversarial sample.

[0054] During the fine-tuning process, the impact of the backdoor trigger gradually weakened, and the success rate of the attack dropped significantly. The first stage of fine-tuning training is performed using the generated adversarial samples. The goal of this stage is to reduce the model's sensitivity to backdoor triggers by allowing the model to learn these adversarial samples. During the training process, the backdoor neurons will be targeted for damage, but a small number of neurons will also be damaged, so the ASR will drop significantly and the ACC will drop slightly. Although the reduction in ACC is not the result we want, the significant reduction in ASR is the main purpose of this stage. Through this stage of training, the model gradually loses its sensitivity to backdoor triggers, thereby improving its robustness to backdoor attack samples. The first stage of training uses adversarial samples x adv Fine-tune the model to reduce the sensitivity of the model to backdoor triggers and reduce ASR. The optimization goal of this process can be expressed as:

[0055]

[0056] where x adv represents the adversarial sample, y target Indicates the backdoor tag, represents the loss function, which measures the model f θ In predicting input x adv With label y target The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

[0057] In the experiment, the number of fine-tuning rounds is set to 50. The learning rate is set to 0.1 in the first five rounds and 0.01 in the subsequent rounds to ensure the stability of training.

[0058] S6. Second stage neuron recovery: After the model has been purified by adversarial samples, a small amount of normal clean samples are used for the second stage of fine-tuning training, with the goal of restoring the classification performance of the model on the original data. Through fine-tuning training with normal samples, the accuracy of the model is gradually restored, while the previous adversarial training stage has significantly reduced the ASR. Therefore, the final model has a higher ACC and lower ASR. The second stage uses clean samples (x clean ,y clean ) to fine-tune and restore the classification performance of the model:

[0059]

[0060] where x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ In predicting input x clean With label y clean The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

[0061] The innovation of this method lies in the combination of two-stage fine-tuning training and backdoor label detection method, which enables the model to effectively resist backdoor attacks and provides a solution to balance security and model performance in practice. The whole process of the method is integrated and expressed as an overall optimization goal. This comprehensive formula reflects the overall goal of optimizing the model's ACC and reducing ASR through adversarial sample purification and recovery training. Assuming the model parameter is θ, the comprehensive optimization goal can be expressed as:

[0062]

[0063] where x adv represents the adversarial sample, ytarget Indicates the backdoor tag, x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ The difference between the predicted input x and the label y. λ is a hyperparameter used to balance the model performance and the ability to resist backdoor attacks.

[0064] Algorithm description As shown in Algorithm 1, we first generate an adversarial sample set, then generate adversarial samples for each clean sample and update its corresponding backdoor label. Through multiple iterations, we use the loss gradient to optimize the adversarial samples and generate more effective attack samples. Then, we calculate the loss and update the model parameters through these adversarial samples, and then fine-tune them through clean samples to finally obtain the model parameters with defensive capabilities.

[0065] In the experiment, clean samples that have not been attacked are used for fine-tuning, with the number of rounds set to 50 and the learning rate set to 0.01. The loss of clean samples is calculated and the model parameters are updated to make the model more dependent on normal sample features and less dependent on backdoor triggers.

[0066] In this invention, by using a fine-tuning method that combines adversarial samples with clean samples, backdoor attacks in deep neural networks are effectively defended. This method can not only weaken the impact of backdoor attacks, but also restore the normal classification ability of the model to a certain extent. Specifically, combined with actual cases, the following points illustrate the feasibility and beneficial effects of this method:

[0067] In theory, adversarial training has been proven to be an effective way to improve the robustness of models. Adversarial examples are generated (such as using the PGD algorithm) by applying small perturbations to the original input samples, so that the model learns how to deal with these perturbations when making incorrect predictions. In this case, using adversarial examples to interfere with the activation of backdoor neurons is a reasonable and effective strategy.

[0068] The projected gradient descent algorithm continuously optimizes the input samples during the iteration process, making it more difficult for the model to identify the backdoor trigger features, thereby destroying the influence of the backdoor trigger on the model. The number of iterations (40 times), step size (0.01) and maximum perturbation range (8 / 255) set in the present invention are reasonable values ​​verified by a large number of adversarial training studies, which can ensure a good balance between model performance and attack defense.

[0069] The purpose of the first stage of fine-tuning is to counter the backdoor label adversarial samples generated by the adversarial attack and fine-tune the model, thereby weakening the sensitivity of the model to the attack samples after the backdoor attack. Backdoor attacks usually implant specific backdoor triggers in the model, so that when the model encounters inputs with backdoor triggers, it will output the backdoor label specified by the attacker, which significantly reduces the security and reliability of the model. The fine-tuning process in this stage attempts to destroy the effect of the backdoor attack by utilizing adversarial samples, while ensuring that the performance of the model on normal samples remains as unchanged as possible. In order to quickly eliminate the backdoor, a larger learning rate should be used for the first stage of fine-tuning. This paper uses a dynamic learning rate as the learning rate for the first stage of fine-tuning. The learning rate for the first five rounds is 0.1, and the subsequent learning rate is 0.01.

[0070] For Badnets attacks, see Figure 2 , the ASR after fine-tuning decreased from 94.9% to 2.27%, showing the effectiveness of fine-tuning in reducing the model's dependence on the Badnets backdoor trigger. However, the ACC of the model also decreased from 84.94% to 60.74%. This result shows that while weakening the effect of the backdoor attack, the normal classification performance of the model was also affected. For the Blended attack, the results after the first stage of fine-tuning showed that the ASR of the model was significantly reduced from the initial 99.94% to 2.53%, indicating that the model's dependence on the Blended backdoor trigger was almost completely eliminated. However, the ACC of the model also dropped from 84.58% to 65.31% during this process. This also shows that although the threat of backdoor attacks has been greatly alleviated, the classification ability of the model when processing clean data has decreased to a certain extent. This is because some normal neurons have also been affected to a certain extent after fine-tuning using adversarial samples.

[0071] The first stage of fine-tuning effectively achieved a significant reduction in the success rate of the attack, which shows that the fine-tuning strategy successfully destroyed the control of the backdoor trigger over the model. However, at the same time, the classification accuracy of the model dropped significantly, indicating that the model's generalization ability for clean samples was damaged to a certain extent when relearning new features. This phenomenon is relatively common in adversarial sample training. Usually, adversarial interference causes the decision boundary of the model to become more complex, which in turn affects the performance of the model on unseen clean samples.

[0072] In order to verify the key role of adversarial samples in the fine-tuning process, this paper conducted a comparative experiment, using the same parameter settings to perform fifty rounds of traditional fine-tuning on the backdoor samples. The experimental results are shown in the figure. Figure 3As shown in the figure, although the overall classification accuracy of the model has improved, the success rate of backdoor attacks has not decreased significantly. This shows that although traditional fine-tuning can improve the performance of the model for clean samples to a certain extent, it cannot effectively eliminate the hidden backdoors in the model and the activation of backdoor neurons caused by them. This result indirectly reflects the indispensability of adversarial samples in defending against backdoor attacks. Unlike traditional fine-tuning, adversarial fine-tuning can attack and weaken the influence of backdoor neurons in a targeted manner through repeated iterations and optimization of adversarial samples, thereby more effectively reducing the success rate of backdoor attacks. Therefore, relying solely on traditional fine-tuning methods cannot fundamentally eliminate the backdoor risk in the model, which fully illustrates the importance and necessity of introducing adversarial samples. During the fine-tuning process, adversarial samples gradually make the model resist backdoor attacks through targeted attacks, thereby achieving effective defense against backdoors.

[0073] During the first phase of fine-tuning, although the success rate of backdoor attacks was effectively reduced, a problem that followed was that the classification accuracy of the model on clean data dropped significantly. This means that although the model's ability to resist backdoor attacks has been enhanced, its performance when processing normal, non-attacked data has been affected. To address this issue, the second phase of fine-tuning focuses on restoring the classification performance of the model on clean data by further training it.

[0074] The main goal of the second stage of fine-tuning is to restore the classification accuracy of the model on the clean dataset as much as possible while maintaining the ability to resist backdoor attacks obtained in the first stage. In theory, by using clean samples for fine-tuning training, the model can readjust its internal decision boundary to better adapt it to the distribution of normal samples, thereby improving its performance in non-adversarial environments. The key to this process is to adjust the weights of the model so that it can rely more on normal, non-adversarial features and less on features related to backdoor triggers.

[0075] Specifically, the first stage of fine-tuning focuses on enhancing the robustness of the model through adversarial training, making it more resistant to backdoor attacks. However, this adversarial training often causes the model to over-focus on features related to backdoor triggers, which in turn leads to a decrease in performance when processing clean samples. Therefore, the second stage of fine-tuning helps the model relearn features that are more consistent with the normal sample distribution by retraining the model using only clean samples. Through such training, the model is able to gradually adjust its parameters so that its decision boundary returns to a position that can accurately classify clean samples.

[0076] At the same time, this fine-tuning process needs to be done very carefully to prevent the model from excessively "forgetting" the adversarial attack capabilities learned in the first stage. Therefore, an important task of fine-tuning is to find a balance, that is, to restore the classification performance on clean data as much as possible without significantly weakening the model's ability to resist backdoor attacks. Through this gradual adjustment, the model can eventually have both strong adversarial attack capabilities and good classification accuracy, thus performing well in practical applications.

[0077] See also Figure 4 In the Badnets attack scenario, after the second stage of fine-tuning, the ACC of the model recovered from 60.74% to 85.56%, while the ASR further decreased from 2.27% to 0.78%. In the Blended attack scenario, after the second stage of normal sample fine-tuning, the ACC of the model was significantly restored from 65.31% after the first stage of fine-tuning to 86.01%, which shows that the classification ability of the model has been effectively restored. However, the ASR also dropped from 2.53% to 0.84%. This result shows that the second stage of fine-tuning basically maintains the model's ability to resist backdoor attacks while restoring ACC, and the success rate of backdoor attacks decreases again. The results of the second stage of fine-tuning show that by fine-tuning with the original clean samples, the normal classification performance of the model can be significantly restored, and the classification accuracy exceeds that of the initial model, while maintaining a certain degree of defense against backdoor attacks. For Blended and BadNets attacks, the further reduction of ASR shows that normal sample fine-tuning can help the model further get rid of its dependence on backdoor triggers. Overall, the second-stage fine-tuning successfully strikes a good balance between restoring the model classification performance and maintaining the ability to resist backdoor attacks.

[0078] In order to more intuitively demonstrate the effectiveness of this method, the results of each step of the experiment are summarized in Table 1, and the data marked with roughness are the optimal indicators. It can be seen from the table that the model after eliminating the backdoor through the method in this paper can achieve the best in all aspects.

[0079]

[0080] Table 1

[0081] Based on backdoor label detection and a two-stage fine-tuning strategy, the present invention demonstrates effective backdoor attack defense capabilities both in theory and practice. By generating adversarial samples related to backdoor labels and using adversarial sample fine-tuning, the model can gradually resist backdoor attacks and weaken the attack effects. At the same time, through subsequent clean sample fine-tuning, the classification ability of the model is restored. This method not only maintains model performance while ensuring the defense effect, but also effectively solves the problem that traditional fine-tuning methods are difficult to eliminate backdoor attacks, demonstrating its important application value in the field of model security.

[0082] It should be understood that the above description of the preferred embodiments of the present invention is relatively detailed, and it cannot be considered that the protection scope of the present invention is limited to the contents disclosed in the above embodiments and drawings. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, all equivalents or modifications completed without departing from the spirit disclosed in the present invention fall within the protection scope of the present invention.

Claims

1. A defense method against model backdoor attacks, characterized in that: The following steps are involved: A neural cleaning backdoor detection method is used to obtain a backdoor label, which is used to guide the generation of adversarial samples; Generate adversarial samples using the projected gradient descent adversarial attack algorithm; Use the generated adversarial examples to perform the first stage of fine-tuning training; The second stage of fine-tuning training is performed using normal clean samples to restore the classification performance of the model on the original data.

2. The defense method against model backdoor attack according to claim 1, characterized in that: The method of using a neural cleaning backdoor detection method to obtain a backdoor label is specifically as follows: using a neural cleaning method to analyze the input and output of the model, and then reversely deriving a backdoor trigger, and then analyzing and comparing the L1 mask norm value corresponding to the backdoor trigger to determine the backdoor label.

3. The defense method against model backdoor attack according to claim 2, characterized in that: The formula for reversing the backdoor trigger is: δ=argmin δ ||f(x+δ)-y target || (1) Where f is the model, x is the input sample, y is the output prediction, δ is the backdoor trigger, and y traget Backdoor label, argmin δ represents the minimum perturbation required to make the model predict the backdoor label.

4. The defense method against model backdoor attack according to claim 1, characterized in that: The formula for the adversarial sample generated by the projected gradient descent algorithm can be expressed as: in, is the loss function, B ∈ (x) is the neighborhood with x as the center and radius ∈, x adv is the generated adversarial sample, y clean is the original label of the sample.

5. The defense method against model backdoor attack according to claim 1, characterized in that: The first stage of fine-tuning training is specifically: using the generated adversarial sample set, using a dynamic learning rate and a set number of fine-tuning rounds for training, and the specific optimization target formula is: Among them, x adv represents the adversarial sample, y target Indicates the backdoor tag, represents the loss function, which measures the model f θ In predicting input x adv With label y target The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

6. The method for defending against model backdoor attacks according to claim 1, characterized in that: The clean samples are subjected to the second stage of fine-tuning training, using (x clean ,y clean ) for fine-tuning, the specific optimization target formula is: where x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ In predicting input x clean With label y clean The difference, min θ represents adjusting the model parameters θ to minimize the loss function.

7. The defense method against model backdoor attack according to claim 6, characterized in that: It also includes a comprehensive optimization target after the fine-tuning training in the first stage and the fine-tuning training in the second stage, and the comprehensive optimization target can be expressed as: where x adv represents the adversarial sample, y target Indicates the backdoor tag, x clean represents a clean sample, y clean represents the true label, represents the loss function, which measures the model f θ The difference between the predicted input x and the label y. λ is a hyperparameter used to balance the model performance and the ability to resist backdoor attacks.

8. A defense system against model backdoor attacks, characterized in that: include: A backdoor label detection module, used to obtain a backdoor label using a neural cleaning backdoor detection method, wherein the backdoor label is used to guide the generation of adversarial samples; Adversarial sample generation module, used to generate adversarial samples using the projected gradient descent adversarial attack algorithm; The first-stage fine-tuning module is used to perform the first-stage fine-tuning training using the generated adversarial samples; The second-stage fine-tuning module is used to perform the second-stage fine-tuning training using normal clean samples to restore the classification performance of the model on the original data.

Images