A method for task execution of self-distillation model backdoor removal, electronic equipment and medium

Abstract

The application discloses a task execution method for removing a self-distillation model backdoor, an electronic device and a medium, comprising: obtaining an original task data set and removing labels corresponding to part of samples; performing data augmentation on the labeled data; performing first and second data enhancement operations on the unlabeled data to obtain first and second unlabeled data sets; constructing positive and negative sample pairs; inputting the first and second unlabeled data sets into first and second feature extraction models; constructing a contrast loss and a self-distillation feature map loss to train the first feature extraction model, the contrast loss gradually increases the distance between the feature vectors corresponding to the negative sample pairs and gradually reduces the distance between the feature vectors corresponding to the positive sample pairs; updating the second feature extraction model by momentum; inputting the augmented labeled data into the trained first feature extraction model, constructing a cross-entropy loss, and training the first feature extraction model again; and executing the task by using the trained first feature extraction model.

Description

Technical Field

[0001] This invention belongs to the field of model backdoor removal technology, and particularly relates to a task execution method, electronic device, and medium for self-distillation model backdoor removal. Background Technology

[0002] In recent years, deep learning technology has experienced rapid development and has been widely applied in many fields, such as image recognition, natural language processing, and speech recognition. Since training models from scratch requires a large amount of computing resources, obtaining pre-trained model backbones from third-party platforms and using them for various downstream tasks has become increasingly popular. However, this has also brought about many security issues, the most prominent of which is backdoor attacks.

[0003] The targets of backdoor attacks are:

[0004] (1) The backdoor model has normal accuracy on clean test samples;

[0005] (2) The backdoor model will produce a prediction result specified by the attacker if and only if the test sample contains a pre-set backdoor trigger.

[0006] Objective (1) ensures the stealth of the backdoor attack, while objective (2) ensures that the backdoor model can be manipulated arbitrarily by the attacker. Attackers insert backdoor triggers into the target model before or during training, causing the model to produce incorrect or manipulated outputs when given specific inputs during testing. This could have dire consequences in real-world applications. For example, a traffic sign recognition system using a backdoor model might consistently misclassify a "STOP" sign as "GO STRAIGHT" when a specific pattern appears, leading to serious security problems. Therefore, effective defense against backdoor attacks is a highly challenging task. Currently, the main defense strategies against backdoor attacks include backdoor model detection, backdoor sample detection, and backdoor removal. Among these, backdoor removal is the most critical.

[0007] The primary goal of backdoor removal is to remove backdoors from backdoor models while maintaining the model's normal performance. Backdoor removal is crucial for backdoor defense and plays a significant role in practical applications; therefore, most backdoor defense work revolves around backdoor removal.

[0008] Existing backdoor removal methods can be broadly categorized into two types:

[0009] (1) Removal during training: Detect potential backdoor samples during the training process of the model and prevent the model from learning these samples;

[0010] (2) Remove after training: Remove the backdoor triggers that have been implanted from the backdoor model to restore the pure function of the model.

[0011] Currently, the main methods for backdoor removal include fine-tuning and model attention distillation. Fine-tuning integrates pruning and fine-tuning techniques to effectively eliminate backdoors in the model. It first uses pruning to remove backdoor neurons associated with triggers from the backdoor model, achieving model cleanup. Then, it fine-tunes with a small amount of clean data to restore the model's performance on clean samples. Model attention distillation removes backdoor triggers using knowledge distillation and a small amount of clean data. Because knowledge distillation involves two models (a teacher model and a student model), backdoor defense based on knowledge distillation requires selecting appropriate teacher and student models. The core of this method lies in finding suitable attention representations to ensure the effectiveness of distillation defense.

[0012] However, even advanced techniques like Neural Attention Distillation (NAD) and Adversarial Pruning (ANP) cannot defend against attacks like ATTEQ-NN. Furthermore, existing backdoor removal methods not only fail to repair the performance damage caused by backdoor injection but also further degrade model performance, hindering the further application of backdoor removal methods. In addition, most existing methods perform backdoor removal distillation under conditions of abundant clean data and complete labels; they cannot achieve effective backdoor removal in scenarios with only a small amount of clean data and missing labels. Summary of the Invention

[0013] To address the shortcomings of existing technologies, this invention provides a task execution method, electronic device, and medium for removing backdoors from self-distillation models.

[0014] In a first aspect, embodiments of the present invention provide a task execution method for removing a backdoor from a self-distillation model, the method comprising:

[0015] Obtain the original task dataset and remove the labels corresponding to some samples in the original task dataset;

[0016] Data augmentation is performed on the labeled data in the original task dataset;

[0017] Perform a first data augmentation operation and a second data augmentation operation on the unlabeled data in the original task dataset to obtain a first unlabeled dataset and a second unlabeled dataset;

[0018] Two samples obtained after performing the first and second data augmentation operations on an unlabeled sample are considered as a positive sample pair; a sample obtained after data augmentation on an unlabeled sample and a sample obtained after data augmentation on another unlabeled sample are considered as a negative sample pair.

[0019] Construct a first feature extraction model and a second feature extraction model identical to it; input a first unlabeled dataset into the first feature extraction model, and input a second unlabeled dataset into the second feature extraction model; construct a contrastive loss and a self-distilled feature map loss to train the first feature extraction model, wherein the contrastive loss is used to minimize the distance between feature vectors corresponding to positive samples and maximize the distance between feature vectors corresponding to negative samples; update the second feature extraction model through momentum.

[0020] The amplified labeled data is input into the trained first feature extraction model, and the cross-entropy loss is constructed to retrain the first feature extraction model.

[0021] The task is performed using the trained first feature extraction model.

[0022] Furthermore, the process of performing a first data augmentation operation and a second data augmentation operation on the unlabeled data in the original task dataset to obtain the first unlabeled dataset and the second unlabeled dataset includes:

[0023] Perform a first data augmentation operation on the unlabeled data in the original task dataset to obtain a first unlabeled dataset; perform a second data augmentation operation on the unlabeled data in the original task dataset to obtain a second unlabeled dataset.

[0024] The first data augmentation operation is different from the second data augmentation operation.

[0025] Furthermore, the first data augmentation operation and the second data augmentation operation are selected from flipping, rotating, scaling, random cropping, color distortion, or color adjustment.

[0026] Furthermore, the process of constructing the contrastive loss and self-distillation feature map loss to train the first feature extraction model includes:

[0027] The expression for the contrastive loss is as follows:

[0028]

[0029] In the formula, N is the number of samples in the first unlabeled dataset, and q i It is the feature vector obtained by the first feature extraction model from the input sample i. It is the feature vector obtained by the second feature extraction model from the positive sample i as input sample i. It is the feature vector obtained by the second feature extraction model from the negative sample i, which is the input sample i; τ is the temperature coefficient.

[0030] The expression for the self-distillation feature map loss is as follows:

[0031]

[0032] In the formula, F i F represents the output feature of the i-th feature layer. D The output features of the deepest feature layer This represents the sum of the p-th powers of the absolute values ​​of the output features.

[0033] Furthermore, the process of updating the second feature extraction model through momentum includes:

[0034] The expression for momentum update is as follows:

[0035] θ k ←mθ k +(1-m)θ q

[0036] In the formula, θ k These are the parameters of the second feature extraction model, θ q These are the parameters of the main encoder, specifically the parameter θ. q Updated using backpropagation based on contrastive loss, where m is the momentum coefficient.

[0037] Furthermore, the process of constructing the contrastive loss and self-distillation feature map loss to train the first feature extraction model also includes:

[0038] A fully connected layer is added after each feature layer of the first feature extraction model so that the output dimension of each feature layer is the same as the output dimension of the first feature extraction model.

[0039] The process of inputting the amplified labeled data into the trained first feature extraction model also includes:

[0040] A fully connected network is added after the first feature extraction model to reduce the dimensionality of the extracted features to the confidence dimension of the classification.

[0041] Furthermore, constructing the cross-entropy loss model and retraining the first feature extraction model includes:

[0042] The expression for cross-entropy loss is as follows:

[0043]

[0044] In the formula, L i q represents the output of the i-th feature layer. i Let y represent the confidence output of the i-th feature layer, y represent the final softmax output of the first feature extraction model, C represent the number of classes, j represent the j-th class, j∈C, and q represent the confidence output of the i-th feature layer. ij This represents the confidence output of the i-th feature layer on the j-th class.

[0045] Secondly, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-described task execution method for removing the backdoor of the self-distillation model.

[0046] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the above-described task execution method for removing the backdoor of the self-distillation model.

[0047] Fourthly, embodiments of the present invention provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the aforementioned task execution method for removing the backdoor of the self-distillation model.

[0048] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0049] This invention employs comparative learning to perform feature self-distillation on unlabeled data and label self-distillation on a small amount of labeled data, thereby achieving backdoor removal across the entire network while maintaining the model's primary task performance. The first feature model trained using this invention significantly reduces the success rate of backdoor attacks while preserving its primary task performance, and also demonstrates excellent defense against various backdoor attacks. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A flowchart illustrating the task execution method for removing the backdoor of the self-distillation model provided in an embodiment of the present invention;

[0052] Figure 2 A flowchart illustrating the task execution method for removing the backdoor of a self-distillation model provided in this embodiment of the invention;

[0053] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0056] like Figure 1 and Figure 2 As shown, this embodiment of the invention provides a task execution method for removing the backdoor of a self-distillation model, the method comprising the following steps:

[0057] Step S1: Obtain the original task dataset and remove the labels corresponding to some samples in the original task dataset;

[0058] Data augmentation is performed on the labeled data in the original task dataset;

[0059] Perform a first data augmentation operation and a second data augmentation operation on the unlabeled data in the original task dataset to obtain a first unlabeled dataset and a second unlabeled dataset;

[0060] Two samples obtained after performing the first and second data augmentation operations on an unlabeled sample are considered as a positive sample pair; a sample obtained after data augmentation on an unlabeled sample and a sample obtained after data augmentation on another unlabeled sample are considered as a negative sample pair.

[0061] Specifically, step S1 includes the following sub-steps:

[0062] Step S101: Download and decompress the original task dataset, and match each image sample in the original task dataset with its label.

[0063] It should be noted that the original task dataset can be multimodal (image, text, speech, etc.) data to perform different downstream tasks (image classification, object detection, semantic segmentation, etc.).

[0064] Step S102: Set a first ratio to divide the original task dataset into a training dataset and a test dataset according to the first ratio; set a second ratio to remove the labels corresponding to the samples in the training dataset according to the second ratio.

[0065] Step S103: Perform data augmentation on the labeled data in the training dataset; perform the first data augmentation operation and the second data augmentation operation on the unlabeled data in the original task dataset to obtain the first unlabeled dataset and the second unlabeled dataset, and construct positive sample pairs and negative samples.

[0066] Furthermore, operations including translation, rotation, and scaling are performed on the labeled data in the training dataset to obtain augmented data that is 4 times larger than the original data. This augmented data is then used for subsequent model label self-distillation and performance fine-tuning.

[0067] A first data augmentation operation is performed on the unlabeled data in the original task dataset to obtain a first unlabeled dataset; a second data augmentation operation is performed on the unlabeled data in the original task dataset to obtain a second unlabeled dataset; wherein the first data augmentation operation and the second data augmentation operation are different.

[0068] The process of augmenting the unlabeled data in the training dataset to obtain positive and negative sample pairs includes:

[0069] Two samples obtained by data augmentation of an unlabeled sample in the training dataset are used as a positive sample pair; a sample obtained by data augmentation of an unlabeled sample in the traffic sign training dataset and a sample obtained by data augmentation of another unlabeled sample are used as a negative sample pair; this completes the preprocessing of the original task dataset.

[0070] For example, after data augmentation, two samples A1 and A2 are obtained from an unlabeled sample A in the training dataset, and A1 and A2 are used as positive sample pairs (A1, A2); after data augmentation, two samples B1 and B2 are obtained from an unlabeled sample B in the training dataset, and (A1, B1), (A1, B2), (A2, B1), and (A2, B2) are used as negative sample pairs.

[0071] Step S2: Construct a first feature extraction model and a second feature extraction model identical to it; input the first unlabeled dataset into the first feature extraction model, and input the second unlabeled dataset into the second feature extraction model; construct a contrastive loss and a self-distilled feature map loss to train the first feature extraction model, wherein the contrastive loss is used to minimize the distance between feature vectors corresponding to positive samples and maximize the distance between feature vectors corresponding to negative samples; update the second feature extraction model through momentum.

[0072] A fully connected layer is added after each feature layer of the first feature extraction model so that the output dimension of each feature layer is the same as the output dimension of the first feature extraction model.

[0073] Furthermore, the expression for the contrastive estimation loss (InfoNCE Loss) is as follows:

[0074]

[0075] In the formula, N is the number of samples in the first unlabeled dataset, and q i It is the feature vector obtained by the first feature extraction model from the input sample i. It is the feature vector obtained by the second feature extraction model from the positive sample i as input sample i. It is the feature vector obtained by the second feature extraction model from the negative sample i as input sample i; τ is the temperature coefficient, which is used to adjust the distribution of similarity scores and to control the model's ability to distinguish negative samples.

[0076] It should be noted that if the input samples of the first feature extraction model and the second feature extraction model are positive sample pairs, then it is desirable for their features to be as close as possible, that is, the similarity label is 1. If they are negative sample pairs, then it is desirable for their features to be as far apart as possible, that is, the similarity label is 0.

[0077] Furthermore, the expression for the self-distillation feature map loss is as follows:

[0078]

[0079] In the formula, F i F represents the output feature of the i-th feature layer. D The output features of the deepest feature layer This represents the sum of the p-th powers of the absolute values ​​of the output features.

[0080] It should be noted that the self-distillation feature map loss is the loss between the output features of each shallow feature layer and the output features of the deepest feature layer. By minimizing the difference between the shallow features and the output features, the first feature extraction model achieves feature self-distillation from the deepest layer to the shallowest layer, thus realizing backdoor removal at the output feature level of the entire first feature extraction model.

[0081] Furthermore, the expression for momentum update is as follows:

[0082] θ k ←mθ k +(1-m)θ q

[0083] In the formula, θ k These are the parameters of the second feature extraction model, θ q These are the parameters of the main encoder, specifically the parameter θ. qThe update is based on contrastive loss backpropagation. m is the momentum coefficient, which is usually in the range of 0.99 to 1 and is used to control the update speed of the momentum encoder.

[0084] It should be noted that updating the second feature extraction network at a slower rate using momentum means that its updates are more stable. This ensures that during the contrastive learning process, the feature vectors of negative samples will not change significantly due to the drastic updates of the first feature extraction network. This avoids the loss of feature consistency caused by drastic changes in the first feature extraction network, while also keeping the second feature extraction network in a constantly updated state.

[0085] Step S3: Input the amplified labeled data into the trained first feature extraction model, construct the cross-entropy loss and retrain the first feature extraction model.

[0086] A fully connected network is added after the first feature extraction model to reduce the dimensionality of the extracted features to the confidence dimension of the classification.

[0087] Furthermore, the expression for cross-entropy loss is as follows:

[0088]

[0089] In the formula, L i q represents the output of the i-th feature layer. i Let y represent the confidence output of the i-th feature layer, y represent the final softmax output of the first feature extraction model, C represent the number of classes, j represent the j-th class, j∈C, and q represent the confidence output of the i-th feature layer. ij This represents the confidence output of the i-th feature layer on the j-th class.

[0090] It's important to note that minimizing the difference between the output confidence of the deepest layer and the output confidence of other feature layers utilizes cross-entropy loss to achieve label self-distillation. This improves the performance of the main task while completely removing backdoors at the output confidence level. The fully connected layers added to the feature layers are used solely for label self-distillation, and are removed after backdoor removal. Knowledge hidden in the labeled dataset is directly introduced into the classifiers of all feature layers through labels. As the network progresses from shallow to deep layers, the weights assigned to the classifiers gradually increase, thus achieving backdoor removal.

[0091] Step S4: Perform the task using the trained first feature extraction model.

[0092] Example 1

[0093] This embodiment uses the CTSDB traffic sign dataset as the original task dataset and traffic sign recognition and classification as the downstream task, thereby further illustrating the specific implementation process of the self-distillation model backdoor removal task execution method provided by this invention. Specifically, it includes the following steps:

[0094] Step S1: Obtain the CTSDB traffic sign dataset and remove the labels corresponding to the samples in the CTSDB traffic sign dataset proportionally; perform data augmentation on the labeled data in the CTSDB traffic sign dataset; perform data augmentation on the unlabeled data in the CTSDB traffic sign dataset to obtain a positive sample pair dataset and a negative sample pair dataset.

[0095] Specifically, step S1 includes the following sub-steps:

[0096] Step S101: Download and decompress the CTSDB traffic sign dataset, and match each image sample in the CTSDB traffic sign dataset with its label.

[0097] Specifically, in this example, the CTSDB (China Traffic Sign Database) is selected as the original task dataset. The CTSDB dataset is a dataset specifically created for traffic sign recognition and classification tasks, primarily used in research fields such as autonomous driving and intelligent transportation systems. The CTSDB dataset contains a large number of Chinese traffic sign images, covering various types of traffic signs, such as warning signs, prohibitory signs, and instruction signs.

[0098] Step S102: Set a first ratio and divide the CTSDB traffic sign dataset into a traffic sign training dataset and a traffic sign test dataset according to the first ratio; set a second ratio and remove the labels corresponding to the samples in the traffic sign training dataset according to the second ratio.

[0099] Specifically, in this example, 10,000 images are randomly selected as the traffic sign training dataset and 2,000 images are selected as the traffic sign test dataset. The labels of the traffic sign training dataset are removed in a 7:3 ratio, resulting in a large amount of unlabeled data and a small amount of labeled data in the traffic sign training dataset.

[0100] Step S103: Perform data augmentation on the labeled data in the traffic sign training dataset; perform the first data augmentation operation and the second data augmentation operation on the unlabeled data in the traffic sign training dataset to obtain the first unlabeled dataset and the second unlabeled dataset, and construct positive sample pairs and negative samples.

[0101] Furthermore, in this example, the process of augmenting the labeled data in the traffic sign training dataset includes:

[0102] The labeled data in the traffic sign training dataset is subjected to operations including translation, rotation, and scaling to obtain augmented data that is 4 times larger than the original data. This augmented data is then used for subsequent model label self-distillation and performance fine-tuning.

[0103] Furthermore, in this example, a first data augmentation operation is performed on the unlabeled data in the traffic sign training dataset (in this example, the first data augmentation operation is random pruning) to obtain a first unlabeled dataset; a second data augmentation operation is performed on the unlabeled data in the original task dataset (in this example, the first data augmentation operation is color distortion) to obtain a second unlabeled dataset.

[0104] The process of augmenting the unlabeled data in the traffic sign training dataset to obtain positive and negative sample pairs includes:

[0105] Two samples obtained by random cropping and color distortion of an unlabeled sample in the traffic sign training dataset are used as a positive sample pair; one sample obtained by random cropping and color distortion of an unlabeled sample in the traffic sign training dataset and another sample obtained by random cropping and color distortion of an unlabeled sample in the traffic sign training dataset are used as a negative sample pair; this completes the preprocessing of the CTSDB traffic sign dataset.

[0106] For example, the unlabeled samples {A,B,C,……} in the traffic sign training dataset are randomly cropped to obtain {A1,B1,C1,……}, which serves as the first unlabeled dataset; the unlabeled samples {A,B,C,……} in the traffic sign training dataset are color-distorted to obtain {A2,B2,C2,……}, which serves as the second unlabeled dataset.

[0107] For example, two samples A1 and A2 are obtained by randomly cropping and color distortion of an unlabeled sample A in the traffic sign training dataset. A1 and A2 are taken as positive sample pairs (A1, A2). Two samples B1 and B2 are obtained by randomly cropping and color distortion of an unlabeled sample B in the traffic sign training dataset. (A1, B1), (A1, B2), (A2, B1), and (A2, B2) are taken as negative sample pairs.

[0108] Step S2: Construct a first feature extraction model and a second feature extraction model identical to it; input the first unlabeled dataset into the first feature extraction model, and input the second unlabeled dataset into the second feature extraction model; construct a contrastive loss and a self-distilled feature map loss to train the first feature extraction model, wherein the contrastive loss is used to minimize the distance between feature vectors corresponding to positive samples and maximize the distance between feature vectors corresponding to negative samples; update the second feature extraction model through momentum.

[0109] Step S3: Input the amplified labeled data into the trained first feature extraction model, construct the cross-entropy loss and retrain the first feature extraction model.

[0110] Step S4 involves inputting the traffic sign test dataset into the trained first feature extraction model to obtain the traffic sign recognition results. This example utilizes contrastive learning self-distillation to effectively remove backdoors and protect the performance of the road sign classifier in situations with limited data and missing labels.

[0111] In summary, this invention achieves backdoor removal across the entire network by performing feature self-distillation on unlabeled data and label self-distillation on a small amount of labeled data through contrastive learning. This process simultaneously ensures the model's performance on its primary task. The first feature model trained by this invention significantly reduces the success rate of backdoor attacks while maintaining its primary task performance, and it also provides excellent defense against various backdoor attacks.

[0112] Accordingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; and when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the task execution method for removing the backdoor in the self-distillation model as described above. Figure 3 The diagram shown illustrates a hardware structure of any data processing-capable device where the task execution method for removing the backdoor of the self-distillation model provided in this embodiment of the invention is located, except... Figure 3 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0113] Accordingly, this application also provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the task execution method for removing the backdoor of the self-distillation model as described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0114] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only.

[0115] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A task execution method for removing a backdoor in a self-distillation model, characterized in that, The method includes: Obtain the original task dataset and remove the labels corresponding to some samples in the original task dataset; the original task dataset is selected from multimodal data including images, text, and speech, in order to perform different downstream tasks including image classification, object detection, and semantic segmentation. Data augmentation is performed on the labeled data in the original task dataset; Perform a first data augmentation operation and a second data augmentation operation on the unlabeled data in the original task dataset to obtain a first unlabeled dataset and a second unlabeled dataset; Two samples obtained after performing the first and second data augmentation operations on an unlabeled sample are considered as a positive sample pair; a sample obtained after data augmentation on an unlabeled sample and a sample obtained after data augmentation on another unlabeled sample are considered as a negative sample pair. Construct a first feature extraction model and a second feature extraction model identical to it; input a first unlabeled dataset into the first feature extraction model, and input a second unlabeled dataset into the second feature extraction model; construct a contrastive loss and a self-distilled feature map loss to train the first feature extraction model, wherein the contrastive loss is used to minimize the distance between feature vectors corresponding to positive samples and maximize the distance between feature vectors corresponding to negative samples; update the second feature extraction model through momentum. The amplified labeled data is input into the trained first feature extraction model, and the cross-entropy loss is constructed to retrain the first feature extraction model. The task is performed using the trained first feature extraction model; The process of constructing the contrastive loss and self-distillation feature map loss to train the first feature extraction model includes: The expression for the contrastive loss is as follows: ； In the formula, It is the number of samples in the first unlabeled dataset. It is the feature vector obtained by the first feature extraction model from the input sample i. It is the feature vector obtained by the second feature extraction model from the positive sample i as input sample i. It is the feature vector obtained by using the negative sample of input sample i through the second feature extraction model. It is the temperature coefficient; The expression for the self-distillation feature map loss is as follows: ； In the formula, For the first The output features of the feature layer, The output features of the deepest feature layer This represents the sum of the p-th powers of the absolute values ​​of the output features.

2. The task execution method for removing a backdoor in a self-distillation model according to claim 1, characterized in that, The process of performing a first data augmentation operation and a second data augmentation operation on the unlabeled data in the original task dataset to obtain the first unlabeled dataset and the second unlabeled dataset includes: Perform a first data augmentation operation on the unlabeled data in the original task dataset to obtain a first unlabeled dataset; perform a second data augmentation operation on the unlabeled data in the original task dataset to obtain a second unlabeled dataset. The first data augmentation operation is different from the second data augmentation operation.

3. The task execution method for removing a backdoor in a self-distillation model according to claim 1 or 2, characterized in that, The first data augmentation operation and the second data augmentation operation are selected from flipping, rotating, scaling, random cropping, color distortion, or color adjustment.

4. The task execution method for removing a backdoor in a self-distillation model according to claim 1, characterized in that, The process of updating the second feature extraction model using momentum includes: The expression for momentum update is as follows: ； In the formula, These are the parameters of the second feature extraction model. These are the parameters of the main encoder. Updated using backpropagation based on contrastive loss, where m is the momentum coefficient.

5. The task execution method for removing a backdoor in a self-distillation model according to claim 1, characterized in that, The process of constructing the contrastive loss and self-distillation feature map loss to train the first feature extraction model also includes: A fully connected layer is added after each feature layer of the first feature extraction model so that the output dimension of each feature layer is the same as the output dimension of the first feature extraction model. The process of inputting the amplified labeled data into the trained first feature extraction model also includes: A fully connected network is added after the first feature extraction model to reduce the dimensionality of the extracted features to the confidence dimension of the classification.

6. The task execution method for removing a backdoor in a self-distillation model according to claim 1, characterized in that, The process of constructing a cross-entropy loss model and retraining the first feature extraction model includes: The expression for cross-entropy loss is as follows: ； In the formula, This represents the output of the i-th feature layer. Let y represent the confidence output of the i-th feature layer, y represent the final softmax output of the first feature extraction model, C represent the number of classes, and j represent the j-th class, j∈C. This represents the confidence output of the i-th feature layer on the j-th class.

7. An electronic device comprising a memory and a processor, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the task execution method for removing the backdoor of the self-distillation model as described in any one of claims 1-6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the task execution method for removing the backdoor of the self-distillation model as described in any one of claims 1-6.

9. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the task execution method for removing the backdoor of the self-distillation model as described in any one of claims 1-6.

Images