Backdoor attack detection method for industrial deep learning model

Abstract

The invention belongs to the technical field of industrial machine learning security, and discloses a backdoor attack detection method for an industrial deep learning model. And constructing a fault model, generating a backdoor attack trigger for a plurality of classifications, training a damaged model, and simulating a deep learning attacked scene in an industrial scene. After a damaged model is obtained through training, an optimal trigger possibly existing in each classification label of the model is sought through traversal, a replaceable trigger matched with a sample is obtained through reverse calculation, and whether the model is attacked or not is judged through median calculation. According to the method, the characteristic of dense industrial data distribution is fitted while the rear door detection precision is met. Compared with an existing NC method, the method has the advantage that the obtained trigger is more accurate.

Description

Technical Field

[0001] The present invention relates to the field of industrial machine learning security technology, and in particular to a backdoor attack detection method for industrial deep learning models. Background Art

[0002] The integration of information technology (IT) and operational technology (OT) is a key trend in the development of contemporary industrial systems. For a long time, IT has been used for business management, while OT has been focused on controlling and monitoring industrial processes. However, with the increasing demand for real-time data processing, machine learning, and artificial intelligence in industrial systems, the integration of IT and OT has become an inevitable trend, forming the Industrial Internet of Things (IIoT). Through IIoT, equipment on the production line is interconnected to achieve automated production processes, thereby improving production efficiency and product quality.

[0003] However, with the popularization of industrial IoT, OT systems that were originally in a physically isolated state are facing multiple threats. In IIoT, ensuring the security of the system is crucial for its reliable operation. Failure of any of these components may lead to serious consequences, including equipment damage, safety accidents, economic losses, and even threats to human life.

[0004] In recent years, the use of deep learning models for fault detection, anomaly detection and other functions in the Industrial Internet of Things has become increasingly popular, which helps ensure the smooth operation of industrial systems. However, these models are vulnerable to backdoor attacks, where attackers may implant hidden triggers in the training data. Once the model training is completed, these triggers can activate the backdoor during the model deployment phase, causing the model to make predetermined wrong decisions. Therefore, while promoting industrial intelligence, it is necessary to strengthen the attention and protection of model security.

[0005] The paper "Hou B, Gao J, Guo X, et al. Mitigating the backdoor attack by federated filters for industrial IoT applications [J]. IEEE Transactions on Industrial Informatics, 2021, 18 (5): 3562-3571" proposes a joint backdoor filtering defense method that can identify backdoor inputs and restore data availability through a fuzzy label flipping strategy. By building multiple filters on the server using an interpretable model and sending them randomly to the client, advanced attackers are prevented from evading the defense. By building a joint defense method, attacks on Industrial Internet of Things (IIoT) applications can be defended when trainers train collaborative models in IIoT applications with large-scale computing on global servers. Although the data availability is restored by using a fuzzy label flipping strategy, attacks on IIoT applications are defended. However, this method does not consider the industrial characteristics such as business fixation in the data when defending against backdoor attacks in traditional public datasets. Therefore, this method does not consider the damage to industrial business processes in industrial scenarios when defending against backdoor attacks.

[0006] The paper "Liu Q, Chen L, Jiang H, et al. A collaborative deep learning microservice for backdoor defenses in Industrial IoT networks [J]. Ad Hoc Networks, 2022, 124: 102727." proposes a collaborative deep learning microservice defense method against backdoor attacks. This method uses the strong intentional perturbation (STRIP) and cycle generative adversarial network (CycleGAN) method to defend against backdoor attacks by collaboratively generating backdoor samples. The use of strong intentional perturbation (STRIP) and cycle generative adversarial network (CycleGAN) improves the flexibility and practicality of the defense method, but this method does not have a method to detect whether a backdoor exists, so the defense efficiency is not high.

[0007] In summary, the existing backdoor attack detection methods of industrial deep learning models have problems such as one-sided considerations and overly single scenarios, which makes them difficult to use in industrial control networks and have low practicality. Summary of the invention

[0008] The purpose of this invention is to propose a backdoor attack detection method for industrial deep learning models. Due to the characteristics of fixed business and fixed training cycle in industry, industrial data points are more densely distributed in the sample space, so there are more precise requirements for alternative triggers used for backdoor attack detection. By regularizing the disturbance amount, alternative triggers that meet the industrial sample distribution are generated.

[0009] The technical solution of the present invention is as follows: A backdoor attack detection method for an industrial deep learning model comprises the following steps:

[0010] Step 1: Extract and preprocess training data from industrial data sets according to the distribution characteristics of industrial samples;

[0011] Step 2: Based on the obtained industrial deep learning model, randomly select some data from the training data, add the trigger of the same backdoor attack, and perform training to replace the damaged white-box industrial model;

[0012] Step 3: Use the alternative white-box damaged industrial model after the above training and verification to iteratively calculate the optimal trigger for each classification label;

[0013] Step 4: For the multiple optimal triggers generated in step 3, use the outlier calculation method MAD to determine whether the model to be detected has a backdoor attack, and indicate the label corresponding to the backdoor attack.

[0014] The step 2 is specifically as follows:

[0015] Step 2.1, set the backdoor attack ratio parameter α, set the number of training data to 1+α times the number of original data, uniformly add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set;

[0016] Step 2.2: Build a replacement white-box damaged industrial model, extract local features of the training data by convolving the training data samples, and realize feature learning and spatial hierarchical representation. The calculation formula is as follows;

[0017]

[0018] Among them, f represents the input data, g represents the convolution kernel, m represents the width of the convolution kernel, n represents the height of the convolution kernel, (x, y) is the coordinate of a pixel point in the output feature map; i and j represent the feature coordinates in the convolution layer;

[0019] Step 2.3: After the convolution operation in step 2.2, the local features are downsampled by pooling to reduce the data dimension and retain the key information. The calculation formula is as follows:

[0020]

[0021] Where Z represents the local feature extracted in step 2.2, k represents the pooling window size, and X represents the output feature map obtained after pooling;

[0022] Step 2.4: Minimize the loss function through the gradient descent algorithm to make the alternative white box damaged industrial model converge. The back propagation calculation process is as follows:

[0023]

[0024] δ (l) =((W (l) ) T δ (l+1) )⊙g′(z (l) )

[0025]

[0026] Among them, δ (L) represents the generalized error during the back-propagation of the surrogate white-box damaged industrial model, δ (l) represents the error of the lth layer during the back propagation of the alternative white-box damaged industrial model, represents the partial derivative of the loss function with respect to the output result, ⊙ represents the Hadamard product, which means element-by-element multiplication; g′ represents the derivative of the activation function, z (L) represents the calculated hidden layer weight matrix, z (l) represents the calculated weight matrix of the lth hidden layer, W (l) represents the weight of the lth layer, b (l) represents the bias of the lth layer, and J represents the loss function used in the back-propagation process.

[0027] The specific steps of step three include:

[0028] Step 3.1: From the training set corresponding to each classification label, randomly select the corresponding sample composition as the calculation verification sample set of the optimal trigger;

[0029] Step 3.2: For each validation sample set generated in step 3.1, establish the objective function:

[0030] x att =x∪x trig

[0031] x trig =(1-M)⊙x+M⊙Δ

[0032]

[0033] Where x represents a clean sample, ∥·∥2 represents the L2 norm, ∥·∥1 represents the L1 norm, the loss function is established using LASSO regression, and the optimization algorithm is used to iteratively solve it, M represents the proportion of the feature changes in the sample when the trigger modifies the sample, Δ represents the generated trigger, h(·) represents the replacement white box damaged industrial model, ω1 and ω2 are hyperparameters for controlling regularization, and x att represents the sample set for attack training, x trig represents a sample with a trigger, y t represents the target label, and L represents the cross entropy function:

[0034]

[0035] Among them, q i is the probability distribution of the true label, p i is the output probability distribution of the alternative white-box damaged industrial model. The cross entropy function seeks to minimize the difference between the probability distribution predicted by the alternative white-box damaged industrial model and the probability distribution of the true label, so that the alternative white-box damaged industrial model better fits the backdoor training samples.

[0036] Step 3.3: Randomly initialize M and Δ, pass them into the objective function in step 3.2 for optimization calculation, and obtain the optimal trigger corresponding to each label.

[0037] The specific steps of step 4 include:

[0038] Step 4.1, standardize M and Δ, and calculate the median of M;

[0039] Step 4.2: For each data point, calculate its absolute deviation from the median, that is

[0040] |M i -M median |

[0041] Step 4.3. Add the absolute deviations of all data points and divide by the number of samples to get the average absolute deviation. The calculation formula is as follows:

[0042]

[0043] Where n represents the total number of samples;

[0044] Step 4.4: Arrange the MAD values ​​corresponding to each label in order of size, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each label. att The corresponding industrial deep learning model,detection method detects the correct ratio.

[0045] The beneficial effects of the present invention are as follows: by iteratively analyzing the model labels, significant outliers can be effectively identified; the composition of the backdoor trigger and the corresponding target label can be determined to achieve reasonable limits on the trigger size; and the L2 regularization term can be used to significantly reduce the difference between the trigger and the original data features. By combining these technical means, the accuracy of the trigger is successfully improved, and a deep learning model security protection method suitable for industrial environments is constructed. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of a backdoor attack detection method for industrial deep learning models;

[0047] Figure 2-Figure 3 The specific data file composition of the embodiment;

[0048] Figure 4 This is the data distribution diagram of the IR007 file;

[0049] Figure 5(a)-Figure 5(e) Triggers generated for NC;

[0050] Figure 6(a)-Figure 6(e) The backdoor trigger generated by the method of the present invention. DETAILED DESCRIPTION

[0051] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0052] The vibration data from the DE side of the Case Western Reserve University bearing data set was used for training and testing. The sampling frequency was 48kHZ. The model was a fault classification model that fits the fault detection business in industrial scenarios. The traditional CNN was used to build a fault model, and backdoor attack triggers were generated for multiple classifications. The damaged model was trained to simulate the scenario of deep learning being attacked in industrial scenarios. After the damaged model was trained, the optimal trigger that may exist in each classification label of the model was traversed, and the alternative trigger that matches the sample was obtained through reverse calculation. The median calculation was used to determine whether the model was attacked.

[0053] refer to Figure 1 As shown in the figure, the industrial deep learning backdoor attack detection process of the present invention includes the following steps. This example uses the motor end bearing fault data from the public Case Western Reserve University bearing data set, and classifies them into three types: inner ring fault, rolling element fault, and outer ring relative position. Three types are selected from different fault diameters, and normal data is combined to form ten types of training data. The specific data files and data distribution are as follows: Figure 2-Figure 4 A backdoor attack detection method for industrial deep learning models, the algorithm steps are as follows:

[0054] Step 1: Extract the data required for CNN model training from the Case Western Reserve University bearing dataset according to the distribution characteristics of industrial samples. The specific steps are as follows:

[0055] Step 1.1, select the fault data of the motor end bearing at a sampling rate of 48kHz from the Case Western Reserve University bearing data set, and obtain the corresponding mat file;

[0056] Step 1.2, from the file obtained in step 1.1, extract 9 sets of data with motor speed of 1797r / min and fault diameters of 0.1778mm, 0.3556mm, and 0.5334mm, respectively, which are "B007", "B014", "B021", "IR007", "IR014", "IR021", "OR007", "OR014", and "OR021", and standardize and normalize the data;

[0057] Step 1.3, query and fill in the missing values ​​in the data obtained in step 1.1 with 0;

[0058] Step 1.4: Divide the data into training data x and training data x in a ratio of 8:2. train , the true training prediction value y train , test data x test , the true test prediction value y test .

[0059] Step 2: Randomly select a portion of the training data, add triggers of the same backdoor attack, and train and verify the damaged industrial model;

[0060] Step 2.1, set the backdoor attack ratio parameter α, set the total data quantity 1+α, uniformly add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set;

[0061] Step 2.2: Build a model, extract local features of data by convolution of samples, realize feature learning and spatial hierarchical representation, and the calculation formula is as follows;

[0062]

[0063] Among them, f and g represent the input data and convolution kernel respectively, m and n represent the width and height of the convolution kernel respectively, and (x, y) is the coordinate of a pixel point in the output feature map.

[0064] Step 2.3: Downsample local features through pooling to reduce data dimensions and retain key information, thereby improving the computational efficiency and generalization of the deep learning model. The calculation formula is as follows:

[0065]

[0066] Among them, Z represents the input feature map, k represents the pooling window size, and X represents the output feature map.

[0067] Step 2.4: Minimize the loss function through the gradient descent algorithm to make the model converge, and finally obtain the time series prediction model. The back propagation calculation process is as follows:

[0068]

[0069] δ (l) =((W (l) ) T δ (l+1) )⊙g′(z (l) )

[0070]

[0071] Among them, δ (l) represents the error of the lth layer, represents the partial derivative of the loss function with respect to the output result, ⊙ represents the Hadamard product, i.e., element-by-element multiplication, g′ represents the mentor of the activation function, W (l) and b (l) They represent the weight and bias of the lth layer respectively.

[0072] Step 3: Use the above deep learning model to iteratively calculate the optimal trigger for each tag. The specific steps include:

[0073] Step 3.1: From the training set corresponding to each label, randomly select the corresponding sample composition as the calculation verification sample set of the optimal trigger;

[0074] Step 3.2: For each validation sample set generated in step 3.1, establish the objective function:

[0075] x att =x∪x trig

[0076] x trig =(1-M)⊙x+M⊙Δ

[0077]

[0078] Among them, ∥·∥2 represents the L2 norm, ∥·∥1 represents the L1 norm, the loss function is established by LASSO regression, and the optimization algorithm is used to iteratively solve it, M represents the proportion of sample changes when the trigger modifies the sample, Δ represents the generated trigger, f(·) represents the deep learning model, α and β are the hyperparameters that control regularization, x att represents the sample set for attack training, x trig represents a sample with a trigger, and L represents the cross entropy function:

[0079]

[0080] where q i is the probability distribution of the true label, p i is the output probability distribution of the model. The cross entropy function can find the minimum difference between the probability distribution predicted by the model and the probability distribution of the true label, so that the model can better fit the backdoor training samples.

[0081] Step 3.3: Randomly initialize M and Δ, pass them into the objective function in step 3.2 for optimization calculation, and obtain the trigger corresponding to each label.

[0082] Step 4: For multiple triggers generated by the target function, use the outlier calculation method MAD to determine whether the model has a backdoor attack and indicate the label corresponding to the backdoor attack. The specific steps include:

[0083] Step 4.1: Standardize M and Δ. In order to avoid being affected by extreme values, calculate the median of M to improve the robustness to outliers.

[0084] Step 4.2: For each data point, calculate its absolute deviation from the median, that is

[0085] |M i -M median |

[0086] Step 4.3. Add the absolute deviations of all data points and divide by the number of samples to get the average absolute deviation. The calculation formula is as follows:

[0087]

[0088] Where n represents the total number of samples.

[0089] Step 4.4: Arrange the MAD values ​​corresponding to each label in order of size, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each label. att The corresponding industrial deep learning model,detection method detects the correct ratio.

[0090] Aiming at the characteristics of fixed data distribution and fixed training cycle in industrial control networks, this paper proposes a backdoor attack detection method for industrial deep learning models. The key points include the following three points:

[0091] (1) In the data preprocessing step, the widely used Case Western Reserve University bearing dataset was selected to build a multivariate model, which fully represents the authenticity of industrial data.

[0092] (2) Using clean samples randomly extracted from the data as a basis, we generate attack samples with triggers, train a neural network model with a backdoor, and simulate the scenario where the model in the industrial site is attacked by the backdoor.

[0093] (3) Establish an optimization algorithm to limit the size of triggers, find the optimal trigger for each label of the model, and determine whether the optimal trigger is an anomaly through outlier detection, so as to meet the backdoor detection accuracy while fitting the dense distribution characteristics of industrial data.

[0094] In order to verify the effectiveness of the detection method proposed in the present invention and the limitation on the trigger size, the effectiveness of the attack in the experiment is firstly demonstrated through experiments, and the effectiveness of the method and the limitation on the trigger size are demonstrated through multiple groups of experiments.

[0095] (1) Attack effectiveness:

[0096] The generated industrial deep learning model is tested for accuracy using a test set and for attack success rate using an attack sample set. The damaged model targeted by each label is tested by dividing the data set into windows of 1024 sample points to evaluate whether the damaged model itself is attacked and whether the model can complete industrial business normally. The experimental results are shown in Table 1. The damaged model meets high accuracy when the test set is passed in, and at the same time meets high attack success rate, indicating that there is a backdoor attack in the damaged model.

[0097] Table 1 Experimental results of damaged model test

[0098]

[0099] (2) Validity of the detection method:

[0100] First, for each label in the ten categories, the test set is extracted, and the optimization objective function is constructed. The ADAM algorithm is used to optimize the function, and the trigger parallelism comparison for each label is calculated to determine whether there is a backdoor attack. The experimental results are shown in Table 2. It can be seen that the model can successfully detect backdoor attacks with high accuracy, and the accuracy is not reduced compared with the traditional method.

[0101] Table 2. Experimental results of model backdoor detection

[0102] Label 0 1 2 3 4 5 6 7 8 9 NC 82.19 86.2 100 99.9 87.33 95.64 80.55 86.36 94.33 94.33 This method 82.11 85.7 100 99.56 87.1 96.35 80.15 84.21 96.5 97.31

[0103] (3) The detected trigger is more accurate:

[0104] The present invention restricts the triggers during the optimization of the objective function, making the calculated optimal trigger more accurate and more suitable for the distribution of industrial samples, thus providing support for the recovery of backdoor attacks. The experimental results are as follows: Figure 5(a)-Figure 5(e) as well as Figure 6(a)-Figure 6(e) As shown, the trigger obtained by this method is more accurate.

[0105] In view of the above observations, the method proposed in the present invention can effectively detect backdoor attacks and propose attack triggers by generating a backdoor trigger for each label of the industrial deep learning model. When the evaluation indicators have no obvious changes compared with the original indicators, the accuracy of the generated attack triggers is higher than that of the original method.

[0106] The above preferred implementation modes are only for illustrating the technical concept and features of the present invention, and the purpose is to enable technicians in this field to understand the content of the present invention and implement it. It cannot be used to limit the protection scope of the present invention. All equivalent changes or modifications made according to the essence of the present invention belong to the protection scope of the present invention.

Claims

1. A backdoor attack detection method for industrial deep learning models, characterized in that: The steps include: Step 1: Extract and preprocess training data from industrial data sets according to the distribution characteristics of industrial samples; Step 2: Based on the obtained industrial deep learning model, randomly select some data from the training data, add the trigger of the same backdoor attack, and perform training to replace the damaged white-box industrial model; Step 3: Use the alternative white-box damaged industrial model after the above training and verification to iteratively calculate the optimal trigger for each classification label; Step 4: For the multiple optimal triggers generated in step 3, use the outlier calculation method MAD to determine whether the model to be detected has a backdoor attack, and indicate the label corresponding to the backdoor attack.

2. The backdoor attack detection method for industrial deep learning models according to claim 1 is characterized in that: The step 2 is specifically as follows: Step 2.1, set the backdoor attack ratio parameter α, set the number of training data to 1+α times the number of original data, uniformly add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set; Step 2.2: Build a replacement white-box damaged industrial model, extract local features of the training data by convolving the training data samples, and realize feature learning and spatial hierarchical representation. The calculation formula is as follows; Among them, f represents the input data, g represents the convolution kernel, m represents the width of the convolution kernel, n represents the height of the convolution kernel, (x, y) is the coordinate of a pixel point in the output feature map, and i and j represent the feature coordinates in the convolution layer; Step 2.3: After the convolution operation in step 2.2, the local features are downsampled by pooling to reduce the data dimension and retain the key information. The calculation formula is as follows: Where Z represents the local feature extracted in step 2.2, k represents the pooling window size, and X represents the output feature map obtained after pooling; Step 2.4: Minimize the loss function through the gradient descent algorithm to make the alternative white box damaged industrial model converge. The back propagation calculation process is as follows: Among them, δ (L) represents the generalized error during the back-propagation of the surrogate white-box damaged industrial model, δ (l) represents the error of the lth layer during the back propagation of the alternative white-box damaged industrial model, represents the partial derivative of the loss function with respect to the output result, ⊙ represents the Hadamard product, which means element-by-element multiplication; g′ represents the derivative of the activation function, z (L) represents the calculated hidden layer weight matrix, z (l) represents the calculated weight matrix of the lth hidden layer, W (l) represents the weight of the lth layer, b (l) represents the bias of the lth layer, and J represents the loss function used in the back-propagation process.

3. The backdoor attack detection method for industrial deep learning models according to claim 1 or 2, characterized in that: The specific steps of step three include: Step 3.1: From the training set corresponding to each classification label, randomly select the corresponding sample composition as the calculation verification sample set of the optimal trigger; Step 3.2: For each validation sample set generated in step 3.1, establish the objective function: x att =x∪x trig x trig =(1-M)⊙x+M⊙Δ Where x represents a clean sample, ∥·∥2 represents the L2 norm, ∥·∥1 represents the L1 norm, the loss function is established using LASSO regression, and the optimization algorithm is used to iteratively solve it, M represents the proportion of the feature changes in the sample when the trigger modifies the sample, Δ represents the generated trigger, h(·) represents the replacement white box damaged industrial model, ω1 and ω2 are hyperparameters for controlling regularization, and x att represents the sample set for attack training, x trig represents a sample with a trigger, y t represents the target label, and L represents the cross entropy function: Among them, q i is the probability distribution of the true label, p i is the output probability distribution of the alternative white-box damaged industrial model. The cross entropy function seeks to minimize the difference between the probability distribution predicted by the alternative white-box damaged industrial model and the probability distribution of the true label, so that the alternative white-box damaged industrial model better fits the backdoor training samples. Step 3.3: Randomly initialize M and Δ, pass them into the objective function in step 3.2 for optimization calculation, and obtain the optimal trigger corresponding to each label.

4. The backdoor attack detection method for industrial deep learning models according to claim 3 is characterized in that: The specific steps of step 4 include: Step 4.1, standardize M and Δ, and calculate the median of M; Step 4.2: For each data point, calculate its absolute deviation from the median, that is |Mi-Mmedian| Step 4.

3. Add the absolute deviations of all data points and divide by the number of samples to get the average absolute deviation. The calculation formula is as follows: Where n represents the total number of samples; Step 4.4: Arrange the MAD values ​​corresponding to each label in order of size, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each label. att The corresponding industrial deep learning model,detection method detects the correct ratio.

Images