A backdoor attack detection method for industrial deep learning model

Abstract

The application belongs to the technical field of industrial machine learning security, and discloses a backdoor attack detection method for an industrial deep learning model. A fault model is constructed, a plurality of classification backdoor attack triggers are generated, a damaged model is trained, and a deep learning attack scenario in an industrial scene is simulated. After the damaged model is obtained through training, the optimal trigger possibly existing in each classification label of the model is sought through traversal, the replaceable trigger matched with the sample is obtained through reverse calculation, and whether the model is attacked is judged through median calculation. The application meets the backdoor detection accuracy while fitting the characteristics of the dense distribution of industrial data. Compared with the existing NC method, the trigger obtained by the method is more accurate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial machine learning security, and particularly relates to a backdoor attack detection method for an industrial deep learning model. BACKGROUND

[0002] The fusion of information technology (IT) and operational technology (OT) is a key trend in the development of contemporary industrial systems. For a long time, IT has been used for business management, while OT has been focused on controlling and monitoring industrial processes. However, with the increasing demand for real-time data processing, machine learning and artificial intelligence in industrial systems, the fusion of IT and OT has become an inevitable trend, forming the industrial Internet of Things (IIoT). Through IIoT, devices on the production line are connected to each other, realizing automated production processes, thereby improving production efficiency and product quality.

[0003] However, with the popularity of industrial Internet of Things, OT systems originally in a state of physical isolation are facing a variety of threats. In IIoT, ensuring the security of the system is crucial for its reliable operation. Failure of any of these components can lead to serious consequences, including damage to devices, safety incidents, economic losses, and even threats to human life.

[0004] In recent years, the use of deep learning models for fault detection, anomaly detection and other functions in industrial Internet of Things has become increasingly popular, which helps to ensure the smooth operation of industrial systems. However, these models are vulnerable to backdoor attacks, and attackers can implant hidden triggers in the training data. Once the model is trained, these triggers can activate the backdoor during the model deployment phase, causing the model to make predetermined wrong decisions. Therefore, while promoting industrial intelligence, attention and protection must be paid to model security.

[0005] The paper "Hou B, Gao J, Guo X, et al. Mitigating the backdoor attack by federated filters for industrial IoT applications[J].IEEE Transactions on Industrial Informatics, 2021, 18(5): 3562-3571." proposes a joint backdoor filtering defense method that can identify backdoor inputs and restore data usability through a fuzzy label flipping strategy. Multiple filters are constructed on the server using an interpretable model and randomly sent to the client to prevent advanced attackers from evading the defense. By constructing a joint defense method, attacks on IIoT applications can be defended when trainers are training collaborative models in industrial IoT (IIoT) applications using large-scale computing on global servers. Although the fuzzy label flipping strategy restores data usability and defends against attacks on IIoT applications, this method does not consider industrial characteristics such as fixed business processes in traditional public datasets. Therefore, when defending against backdoor attacks, this method does not consider the disruption to industrial business processes in industrial scenarios.

[0006] The paper "Liu Q, Chen L, Jiang H, et al. A collaborative deep learning microservice for backdoor defenses in Industrial IoT networks[J]. Ad Hoc Networks, 2022, 124: 102727." proposes a collaborative deep learning microservice defense method against backdoor attacks. This method employs Strongly Intentional Perturbation (STRIP) and CycleGAN to collaboratively generate backdoor samples to defend against backdoor attacks. While using STRIP and CycleGAN improves the flexibility and practicality of the defense method, it lacks a method for detecting the existence of backdoors, resulting in low defense efficiency.

[0007] In summary, existing backdoor attack detection methods for industrial deep learning models suffer from problems such as one-sided problem considerations and overly simplistic scenarios, making them difficult to use in practical applications in industrial control networks and thus lacking practicality. Summary of the Invention

[0008] The purpose of this invention is to propose a backdoor attack detection method for industrial deep learning models. Due to the fixed business operations and training cycles in industry, industrial data points are more densely distributed in the sample space. Therefore, there are higher requirements for the accuracy of alternative triggers used for backdoor attack detection. By applying regularization constraints to the perturbation amount, alternative triggers that satisfy the industrial sample distribution are generated.

[0009] The technical solution of this invention is as follows: A backdoor attack detection method for industrial deep learning models, comprising the following steps:

[0010] Step 1: Extract and preprocess training data from the industrial dataset according to the characteristics of the industrial sample distribution.

[0011] Step 2: Based on the obtained industrial deep learning model, randomly select a portion of the training data, add triggers of the same backdoor attack, and train the replacement white-box damaged industrial model.

[0012] Step 3: Iteratively calculate the optimal trigger for each classification label using the alternative white-box damaged industrial model that has been trained and validated above;

[0013] Step 4: For the multiple optimal triggers generated in Step 3, use the outlier value calculation method MAD to determine whether the model to be detected has a backdoor attack, and indicate the label corresponding to the backdoor attack.

[0014] Step two specifically involves:

[0015] Step 2.1: Set the backdoor attack ratio parameter α, set the number of training data to 1+α times the number of original data, add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set;

[0016] Step 2.2: Build an alternative white-box damaged industrial model. By convolving the training data samples, extract the local features of the training data to achieve feature learning and spatial hierarchical representation. The calculation formula is as follows;

[0017]

[0018] Where f represents the input data, g represents the convolution kernel, m represents the width of the convolution kernel, n represents the height of the convolution kernel, (x,y) is the coordinate of a pixel in the output feature map; i and j represent the feature coordinates in the convolutional layer.

[0019] Step 2.3: After the convolution operation in Step 2.2, pooling is used to downsample local features, reducing data dimensionality while retaining key information. The calculation formula is as follows:

[0020]

[0021] Where Z represents the local features extracted in step 2.2, k represents the pooling window size, and X represents the output feature map obtained after pooling.

[0022] Step 2.4: Minimize the loss function using the gradient descent algorithm to bring the alternative white-box damaged industrial model to converge. The backpropagation calculation process is as follows:

[0023]

[0024] δ (l) =((W) (l) ) T δ (l+1) )⊙g′(z (l) )

[0025]

[0026] Where, δ (L) δ represents the generalized error during backpropagation of the alternative white-box damaged industrial model. (l) This represents the error of layer l during backpropagation in the replacement white-box damaged industrial model. represents the partial derivative of the loss function with respect to the output, ⊙ represents the Hadamard product, and represents element-wise multiplication; g′ represents the derivative of the activation function, z (L) The calculated hidden layer weight matrix, z (l) W represents the calculated weight matrix of the l-th hidden layer. (l) b represents the weight of the l-th layer. (l) Let J represent the bias of the l-th layer, and J represent the loss function used in the backpropagation process.

[0027] The specific steps of step three include:

[0028] Step 3.1: Randomly select samples from the training set corresponding to each classification label to form the calculation and verification sample set for the optimal trigger;

[0029] Step 3.2: For each validation sample set generated in Step 3.1, establish the objective function:

[0030] x att =x∪x trig

[0031] x trig = (1-M)⊙x+M⊙Δ

[0032]

[0033] Where x represents a clean sample, ∥·∥2 represents the L2 norm, ∥·∥1 represents the L1 norm, LASSO regression is used to establish the loss function, and an optimization algorithm is used to iteratively solve it. M represents the proportion of feature changes in the sample when the trigger modifies the sample, Δ represents the generated trigger, h(·) represents the replacement white-box damaged industrial model, ω1 and ω2 are hyperparameters controlling regularization, and x att Let x represent the set of samples used for attack training. trig This represents a sample with a trigger, y t Let L represent the target label and L represent the cross-entropy function.

[0034]

[0035] Where, q i It is the probability distribution of the true labels, p i It is the output probability distribution of the alternative white-box damaged industrial model. The cross-entropy function seeks to minimize the difference between the probability distribution predicted by the alternative white-box damaged industrial model and the probability distribution of the true label, so that the alternative white-box damaged industrial model can better fit the backdoor training samples.

[0036] Step 3.3: Randomly initialize M and Δ, and pass them into the objective function in step 3.2 for optimization calculation to obtain the optimal trigger for each label.

[0037] The specific steps of step four include:

[0038] Step 4.1: Standardize M and Δ, and calculate the median of M;

[0039] Step 4.2: For each data point, calculate its absolute deviation from the median, i.e.

[0040] |M i -M median |

[0041] Step 4.3: Sum the absolute deviations of all data points, then divide by the sample size to obtain the mean absolute deviation. The calculation formula is as follows:

[0042]

[0043] Where n represents the total number of samples;

[0044] Step 4.4: Sort the MAD values ​​corresponding to each tag in ascending order, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each tag. att The corresponding industrial deep learning model and detection method have a correct detection rate.

[0045] The beneficial effects of this invention are as follows: Iterative analysis of model labels effectively identifies significant outliers; the composition of the backdoor trigger and its corresponding target labels are determined, achieving reasonable limitations on the trigger size; and L2 regularization significantly reduces the difference between the trigger and the original data features. By comprehensively utilizing these techniques, the accuracy of the trigger is successfully improved, and a deep learning model security protection method adapted to industrial environments is constructed. Attached Figure Description

[0046] Figure 1 A flowchart of a backdoor attack detection method for industrial deep learning models;

[0047] Figures 2-3 The specific data file composition is shown in the example.

[0048] Figure 4 This is a data distribution diagram for the IR007 file;

[0049] Figures 5(a)-5(e) Triggers generated for NC;

[0050] Figures 6(a)-6(e) This is a backdoor trigger generated by the method of the present invention. Detailed Implementation

[0051] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0052] Vibration data from the DE end of the bearing dataset at Case Western Reserve University was used for training and testing, with a sampling frequency of 48 kHz. The model is a fault classification model, fitted to fault detection operations in an industrial scenario. A traditional CNN was used to construct the fault model, and backdoor attack triggers were generated for multiple categories to train the compromised model, simulating a scenario where deep learning is attacked in an industrial setting. After obtaining the compromised model, the optimal trigger for each category label in the model was sought by iterating through the data. Alternative triggers matching the samples were obtained through reverse calculation, and the median was used to determine whether the model had been attacked.

[0053] refer to Figure 1 As shown, the industrial deep learning backdoor attack detection process of this invention includes the following steps. This example uses fault data from motor-end bearings in the publicly available Case Western Reserve University bearing dataset. It categorizes faults into three types: inner race faults, rolling element faults, and outer race relative position. Three types are selected from different fault diameters, and normal data is merged to form ten-class training data. The specific data files and data distribution are as follows: Figures 2-4 As shown. A backdoor attack detection method for industrial deep learning models, the algorithm steps are as follows:

[0054] Step 1: Based on the characteristics of industrial sample distribution, extract the data required for CNN model training from the Case Western Reserve University bearing dataset. The specific steps are as follows:

[0055] Step 1.1: Select fault data of motor end bearings at a sampling rate of 48kHz from the Case Western Reserve University bearing dataset and obtain the corresponding .mat file;

[0056] Step 1.2: From the file obtained in Step 1.1, extract 9 sets of data with a motor speed of 1797 r / min and fault diameters of 0.1778 mm, 0.3556 mm, and 0.5334 mm, respectively. These are “B007”, “B014”, “B021”, “IR007”, “IR014”, “IR021”, “OR007”, “OR014”, and “OR021”. Standardize and normalize the data.

[0057] Step 1.3: Query and fill in 0 for missing values ​​in the data obtained in Step 1.1;

[0058] Step 1.4: Divide the data into training data x in an 8:2 ratio. train True training prediction value y train Test data x test Actual test predicted value y test .

[0059] Step 2: Randomly select a portion of the training data, add triggers for the same backdoor attack, and train and verify the compromised industrial model.

[0060] Step 2.1: Set the backdoor attack ratio parameter α, set the total number of data to 1+α, add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set;

[0061] Step 2.2: Build the model by performing convolution on the samples to extract local features of the data, thereby achieving feature learning and spatial hierarchical representation. The calculation formula is as follows;

[0062]

[0063] Where f and g represent the input data and the convolution kernel, respectively, m and n represent the width and height of the convolution kernel, respectively, and (x,y) are the coordinates of a pixel in the output feature map.

[0064] Step 2.3: By downsampling local features through pooling, the data dimensionality is reduced while retaining key information, thereby improving the computational efficiency and generalization ability of the deep learning model. The calculation formula is as follows:

[0065]

[0066] Where Z represents the input feature map, k represents the pooling window size, and X represents the output feature map.

[0067] Step 2.4: Minimize the loss function using the gradient descent algorithm to bring the model to converge, ultimately obtaining the time series prediction model. The backpropagation calculation process is as follows:

[0068]

[0069] δ (l) =((W) (l) ) T δ (l+1) )⊙g′(z (l) )

[0070]

[0071] Where, δ (l) This represents the error of the l-th layer. The partial derivative of the loss function with respect to the output is represented by ⊙, which represents the Hadamard product (element-by-element multiplication), g′ represents the mentor of the activation function, and W... (l) and b (l) These represent the weights and biases of the l-th layer, respectively.

[0072] Step 3: Iteratively calculate the optimal trigger for each label using the deep learning model described above. Specific steps include:

[0073] Step 3.1: Randomly select corresponding samples from the training set corresponding to each label to form the calculation verification sample set for the optimal trigger;

[0074] Step 3.2: For each validation sample set generated in Step 3.1, establish the objective function:

[0075] x att =x∪x trig

[0076] x trig = (1-M)⊙x+M⊙Δ

[0077]

[0078] Where ∥·∥2 represents the L2 norm, ∥·∥1 represents the L1 norm, LASSO regression is used to establish the loss function, and an optimization algorithm is used to iteratively solve it. M represents the proportion of sample modification when the trigger modifies the sample, Δ represents the generated trigger, f(·) represents the deep learning model, α and β are hyperparameters controlling regularization, and x att Let x represent the set of samples used for attack training. trig This represents a sample with a trigger, and L represents the cross-entropy function:

[0079]

[0080] Where q i It is the probability distribution of the true labels, p i It is the output probability distribution of the model. The cross-entropy function can find the minimum difference between the probability distribution predicted by the model and the probability distribution of the true label, so that the model can better fit the backdoor training samples.

[0081] Step 3.3: Randomly initialize M and Δ, and pass them into the objective function in step 3.2 for optimization calculation to obtain the trigger corresponding to each label.

[0082] Step 4: For the multiple triggers generated by the objective function, use the outlier value decomposition (MAD) method to determine if the model contains a backdoor attack, and identify the label corresponding to the backdoor attack. Specific steps include:

[0083] Step 4.1: Standardize M and Δ. To avoid the influence of extreme values, calculate the median of M to improve robustness to outliers.

[0084] Step 4.2: For each data point, calculate its absolute deviation from the median, i.e.

[0085] |M i -M median |

[0086] Step 4.3: Sum the absolute deviations of all data points, then divide by the sample size to obtain the mean absolute deviation. The calculation formula is as follows:

[0087]

[0088] Where n represents the total number of samples.

[0089] Step 4.4: Sort the MAD values ​​corresponding to each tag in ascending order, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each tag. att The corresponding industrial deep learning model and detection method have a correct detection rate.

[0090] This invention addresses the characteristics of fixed data distribution and fixed training cycles in industrial control networks, proposing a backdoor attack detection method for industrial deep learning models. The key points mainly include the following three aspects:

[0091] (1) In the data preprocessing step, the widely used Case Western Reserve University bearing dataset was selected to build a multivariate model, which fully represents the authenticity of industrial data.

[0092] (2) Using clean samples randomly selected from the data as a basis, attack samples with triggers are generated, and a neural network model with a backdoor is trained to simulate the scenario of the industrial field model being attacked by the backdoor.

[0093] (3) Establish an optimization algorithm that limits the size of the trigger. For each label of the model, find the optimal trigger and determine whether the optimal trigger is abnormal by outlier detection, so as to fit the dense distribution of industrial data while meeting the backdoor detection accuracy.

[0094] To verify the effectiveness of the detection method and the limitation on the trigger size in the proposed method of this invention, the effectiveness of the attack in the experiment was first demonstrated through experiments, and the effectiveness of the method and the limitation on the trigger size were demonstrated through multiple sets of experiments.

[0095] (1) Attack effectiveness:

[0096] The generated industrial deep learning model was tested for accuracy using a test set and for attack success rate using an attack sample set. The dataset was divided into windows of 1024 sample points, and each label was used to test the compromised model, evaluating whether the compromised model itself contained an attack and whether it could successfully complete industrial tasks. The experimental results are shown in Table 1. The compromised model achieved high accuracy and a high attack success rate when fed into the test set, indicating the presence of a backdoor attack within the compromised model.

[0097] Table 1. Experimental results of the damaged model test

[0098]

[0099] (2) Validity of the detection method:

[0100] First, for each label in the ten categories, a test set is extracted, and an optimization objective function is constructed. The ADAM algorithm is used to optimize the function, and the parallelism of the triggers for each label is calculated to determine whether a backdoor attack exists. The experimental results are shown in Table 2. It can be seen that the model can successfully detect backdoor attacks with high accuracy, and the accuracy is not reduced compared with traditional methods.

[0101] Table 2 Experimental results of backdoor detection in the model.

[0102] Label 0 1 2 3 4 5 6 7 8 9 NC 82.19 86.2 100 99.9 87.33 95.64 80.55 86.36 94.33 94.33 The method 82.11 85.7 100 99.56 87.1 96.35 80.15 84.21 96.5 97.31

[0103] (3) The detected triggers are more accurate:

[0104] This invention, by imposing constraints on the triggers during the optimization of the objective function, makes the calculated optimal triggers more accurate and better fits the distribution of industrial samples, thus providing support for backdoor attack recovery efforts. Experimental results are as follows:Figures 5(a)-5(e) as well as Figures 6(a)-6(e) As shown, the trigger obtained by this method is more accurate.

[0105] Based on the above observations, the method proposed in this invention can effectively detect backdoor attacks and propose attack triggers by generating backdoor triggers for each label of an industrial deep learning model. Under the condition that the evaluation index does not change significantly compared with the original index, the accuracy of the generated attack triggers is higher than that of the original method.

[0106] The above preferred embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it. They should not be used to limit the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the essence of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A backdoor attack detection method for industrial deep learning models, characterized in that, The steps include the following: Step 1: Extract and preprocess training data from the industrial dataset according to the characteristics of the industrial sample distribution. Step 2: Based on the obtained industrial deep learning model, randomly select a portion of the training data, add triggers of the same backdoor attack, and train the replacement white-box damaged industrial model. Step 3: Iteratively calculate the optimal trigger for each classification label using the alternative white-box damaged industrial model that has been trained and validated above; Step 4: For the multiple optimal triggers generated in Step 3, use the outlier value calculation method MAD to determine whether the model to be detected has a backdoor attack, and indicate the label corresponding to the backdoor attack; Step two specifically involves: Step 2.1: Set the backdoor attack ratio parameter α, set the number of training data to 1+α times the number of original data, add triggers to the samples generated by the backdoor attack, and mix and shuffle them with the original training set; Step 2.2: Build an alternative white-box damaged industrial model. By convolving the training data samples, extract the local features of the training data to achieve feature learning and spatial hierarchical representation. The calculation formula is as follows; Where f represents the input data, g represents the convolution kernel, m represents the width of the convolution kernel, n represents the height of the convolution kernel, (x,y) is the coordinate of a pixel in the output feature map, and i and j represent the feature coordinates in the convolutional layer. Step 2.3: After the convolution operation in Step 2.2, pooling is used to downsample local features, reducing data dimensionality while retaining key information. The calculation formula is as follows: Where Z represents the local features extracted in step 2.2, k represents the pooling window size, and X represents the output feature map obtained after pooling. Step 2.4: Minimize the loss function using the gradient descent algorithm to bring the alternative white-box damaged industrial model to converge. The backpropagation calculation process is as follows: δ (l) =((W (l) ) T δ (l+1) )⊙g′(z (l) ) Where, δ (L) δ represents the generalized error during backpropagation of the alternative white-box damaged industrial model. (l) This represents the error of layer l during backpropagation in the replacement white-box damaged industrial model. represents the partial derivative of the loss function with respect to the output, ⊙ represents the Hadamard product, and represents element-wise multiplication; g′ represents the derivative of the activation function, z (L) z represents the calculated hidden layer weight matrix. (l) W represents the calculated weight matrix of the l-th hidden layer. (l) b represents the weight of the l-th layer. (l) Let J represent the bias of the l-th layer, and J represent the loss function used in the backpropagation process. The specific steps of step three include: Step 3.1: Randomly select samples from the training set corresponding to each classification label to form the calculation and verification sample set for the optimal trigger; Step 3.2: For each validation sample set generated in Step 3.1, establish the objective function: x att =x∪x trig x trig =(1-M)⊙x+M⊙Δ Where x represents a clean sample, ||·||2 represents the L2 norm, and ||·||1 represents the L1 norm. A loss function is established using LASSO regression and solved iteratively using an optimization algorithm. M represents the proportion of feature changes in the sample when the trigger modifies the sample. Δ represents the generated trigger, h(·) represents the replacement white-box damaged industrial model, and ω1 and ω2 are hyperparameters controlling regularization. att Let x represent the set of samples used for attack training. trig This represents a sample with a trigger, y t Let L represent the target label and L represent the cross-entropy function. Where, q i It is the probability distribution of the true labels, p i It is the output probability distribution of the alternative white-box damaged industrial model. The cross-entropy function seeks to minimize the difference between the probability distribution predicted by the alternative white-box damaged industrial model and the probability distribution of the true label, so that the alternative white-box damaged industrial model can better fit the backdoor training samples. Step 3.3: Randomly initialize M and Δ, and pass them into the objective function in step 3.2 for optimization calculation to obtain the optimal trigger for each label.

2. The backdoor attack detection method for industrial deep learning models according to claim 1, characterized in that, The specific steps of step four include: Step 4.1: Standardize M and Δ, and calculate the median of M; Step 4.2: For each data point, calculate its absolute deviation from the median, i.e. |M i -M median | Step 4.3: Sum the absolute deviations of all data points, then divide by the sample size to obtain the mean absolute deviation. The calculation formula is as follows: Where n represents the total number of samples; Step 4.4: Sort the MAD values ​​corresponding to each tag in ascending order, determine whether there is a backdoor trigger implanted by the attacker, and calculate the attack data x corresponding to each tag. att The corresponding industrial deep learning model and detection method have a correct detection rate.

Images