Convolutional neural network backdoor defense method based on potential representation similarity

Abstract

The invention provides a convolutional neural network back door defense method based on potential representation similarity. The method comprises the following implementation steps: acquiring a training sample set; performing iterative training on the convolutional neural network; performing iterative training on the convolutional neural network of the implanted back door; selecting a category sample set; determining a target category of the backdoor attack based on the potential representation similarity; and obtaining a convolutional neural network back door defense result. According to the method, potential representations of the suspicious sample set and the benign sample set are extracted, and the similarity between the potential representations is utilized to determine the target category of the backdoor attack, so that the effectiveness and universality of defense are improved, and the security of the convolutional neural network is guaranteed; and meanwhile, by designing a specific loss function, the convolutional neural network without the backdoor is trained from the convolutional neural network with the implanted backdoor, so that the calculation overhead is reduced, the defense efficiency is improved, and particularly, higher efficiency and applicability are shown on a large-scale data set.

Description

Technical Field

[0001] The present invention belongs to the field of neural network security technology and relates to a convolutional neural network backdoor defense method, specifically to a defense method for convolutional neural network backdoor attacks, which can be applied to autonomous driving, face recognition, finance, chemistry, biology and other fields. Background Art

[0002] Convolutional neural networks are an important architecture in the field of deep learning and are widely used in various computer vision tasks. In practical applications, convolutional neural networks are widely used in image classification, target detection, image segmentation, face recognition and other fields. For example, the facial recognition technology equipped in modern smartphones relies on the accurate extraction and matching of facial features by convolutional neural networks. The visual system of autonomous driving needs to use convolutional neural networks to identify road signs, pedestrians and vehicles. In the medical field, convolutional neural networks are used to analyze medical images, detect lesions from X-rays and CT images, and provide auxiliary diagnosis for doctors. In addition, convolutional neural networks are also used in tasks such as text classification, sentiment analysis, and speech recognition in natural language processing. In recent years, the development of convolutional neural networks has continued to evolve. Classic models such as VGGNet, ResNet, and Inception have brought innovations in structural design, improving model performance and computational efficiency. At the same time, combined with transfer learning technology, convolutional neural networks can be effectively trained on small data sets, reducing the dependence on large-scale labeled data. With the emergence of new technologies and the optimization of network architecture, the application prospects of convolutional neural networks are still broad, promoting breakthroughs in deep learning and artificial intelligence in more fields.

[0003] With the widespread application of convolutional neural networks, their existing problems have also attracted widespread attention. Studies have shown that convolutional neural networks are vulnerable to a data poisoning attack called backdoor attack. This attack is caused by malicious adversaries implanting backdoors during the training of convolutional neural networks. Backdoor samples are generated by implanting pre-designed specific triggers in a part of clean samples, and then these backdoor samples are mixed with other clean samples to form a training data set. The convolutional neural network trained on this untrusted data set can maintain the ability to classify normal samples while showing the ability to maliciously classify samples with specific triggers, namely backdoor samples, into the categories specified by the adversary. The adversary can use this backdoor to initiate malicious behavior. Therefore, backdoor attacks have caused serious security problems for convolutional neural networks, and backdoor attack defense methods for convolutional neural networks are very important and meaningful.

[0004] The existing convolutional neural network backdoor defense process is generally as follows: the defender uses the different behaviors of backdoor samples from normal samples during training to separate suspicious backdoor samples, and uses the remaining benign samples to retrain a clean and backdoor-free convolutional neural network. The backdoor defense effect of the convolutional neural network is evaluated by the backdoor attack success rate and model classification accuracy. A low backdoor attack success rate and a high model classification accuracy indicate the effectiveness of the backdoor defense method. For example, Zhejiang University disclosed a convolutional neural network backdoor defense method in its patent application "A backdoor defense method and device based on an interpretable neural network" (patent application number: CN202311356404.X, application publication number: CN117494112A). This technology obtains the activation value of the last convolutional layer neuron of the input image, and identifies whether there is a backdoor attack by detecting whether the activation value is orthogonal. If a backdoor attack is found, the attack-related neuron parameters are modified, and multiple feature extractors are trained using an integrated algorithm to enhance robustness. The image is input into multiple feature extractors, and the comprehensive results are classified to resist backdoor attacks. This technology improves the accuracy of image classification and the security of classification results. However, this backdoor defense method uses an integrated algorithm and requires training multiple feature extractors, resulting in high computational overhead and high consumption of computing resources. The application of this defense method on large-scale data sets is inefficient; at the same time, this method has weak defense capabilities and unstable defense effects against hidden backdoor attacks, and the effectiveness of the defense method cannot be guaranteed. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and propose a convolutional neural network backdoor defense method based on potential representation similarity to solve the technical problems of weak defense capability against hidden backdoor attacks and low backdoor defense efficiency in the prior art.

[0006] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0007] (1) Obtain training sample set:

[0008] The first training sample set D is composed of N images containing Y categories and some images in one category have backdoor triggers and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y≥2, N≥500, A≥500;

[0009] (2) Iterative training of convolutional neural network:

[0010] Through the first training sample set D trainIteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted;

[0011] (3) Iterative training of the convolutional neural network with the backdoor implanted:

[0012] Through the second training sample set D clean Iteratively train the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers;

[0013] (4) Select category sample set:

[0014] The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, we select T images with the smallest loss value and T images with the largest loss value from each category of samples to form a suspicious sample set. Benign sample set

[0015] (5) Determine the target category of the backdoor attack based on the similarity of potential representations:

[0016] The suspicious sample set corresponding to each category and benign sample set The feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the feature vector of each sample is calculated. The mean of all corresponding latent representations Cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack;

[0017] (6) Obtain the convolutional neural network backdoor defense results:

[0018] Suspicious sample set corresponding to the target category attacked by backdoor The convolutional neural network M1 with the backdoor implanted is iteratively trained to obtain the convolutional neural network M3 with the backdoor eliminated.

[0019] Compared with the prior art, the present invention has the following advantages:

[0020] (1) In the stage of determining the target category of the backdoor attack, the present invention extracts the potential representations corresponding to the suspicious sample set and the benign sample set, and uses the similarity between the two to determine the target category of the backdoor attack. On this basis, the potential representations are further analyzed to obtain the target category information, thereby avoiding the instability caused by directly relying on the potential representations to judge whether there is a backdoor attack in the prior art. This method significantly improves the effectiveness and versatility of the defense and ensures the security of the convolutional neural network.

[0021] (2) The present invention designs a specific loss function and uses target category information to train a backdoor-free convolutional neural network from a backdoor-implanted convolutional neural network, thus avoiding reliance on additional feature extractors to assist in backdoor defense. This method effectively reduces the computational overhead of the defense process and significantly improves defense efficiency, especially when processing large-scale data sets, showing higher efficiency and applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart for implementing the present invention. DETAILED DESCRIPTION

[0023] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0024] Reference Figure 1 , the present invention comprises the following steps:

[0025] Step 1) Obtain the training sample set:

[0026] The first training sample set D is composed of N images containing Y categories and some images in one category have backdoor triggers and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y≥2, N≥500, A≥500;

[0027] In this embodiment, Y=2, N=50000, A=500;

[0028] The backdoor trigger in this step is carefully designed by the attacker and embedded in the training data, so that the model outputs the target result preset by the attacker when facing this specific trigger, while still performing normally under normal input conditions;

[0029] Step 2) Iteratively train the convolutional neural network:

[0030] Through the first training sample set D train Iteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted;

[0031] The convolutional neural network M0 described in this step includes a stacked input layer, multiple convolutional layers and a fully connected layer, and a maximum pooling layer is loaded between adjacent convolutional layers;

[0032] The iterative training of the convolutional neural network M0 described in this step is implemented in the following steps:

[0033] (2a) The number of initial iterations is k, the maximum number of iterations is K, K ≥ 100, and the weight of the convolutional neural network at the kth iteration is W k , and let k = 1, M' = M0;

[0034] (2b) The convolutional neural network M' performs forward propagation on the first training sample to obtain the output probability distribution P of each first training sample n And the corresponding true category probability distribution Q n ;

[0035] (2c) Adopt the cross entropy loss function and output the probability distribution P n And the corresponding true category probability distribution Q n Calculate the loss value L for each first training sample CE , and then use the stochastic gradient descent method to pass L CE To W k Update to get the convolutional neural network M after this iteration k , where L CE and for W k The calculation formulas for updating are:

[0036]

[0037]

[0038] Among them, ∑ represents the summation operation, η represents the learning rate, and W k+1 W k The updated results, represents the partial derivative operation;

[0039] (2d) Determine whether k = K. If so, obtain the trained convolutional neural network M1. Otherwise, set k = k + 1, M' = M k , and execute step (2b);

[0040] Step 3) Iteratively train the convolutional neural network with the backdoor implanted:

[0041] Through the second training sample set D cleanIteratively train the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers;

[0042] The convolutional neural network M1 implanted with the backdoor is iteratively trained in this step. The specific iterative training steps are similar to those in step 2, where the loss value L of each second training sample is calculated. KL , is implemented using the KL divergence loss function, and the calculation formula is:

[0043]

[0044] Among them, P y Indicates that the Y value is The probability vector of ;

[0045] Step 4) Select the category sample set:

[0046] The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, we select T images with the smallest loss value and T images with the largest loss value from each category of samples to form a suspicious sample set. Benign sample set

[0047] The loss value L for each class sample described in this step CE , the calculation formula is:

[0048]

[0049] In this step, since the backdoor attack target class includes both clean images without backdoor triggers and images of other categories with backdoor triggers, and the convolutional neural network M2 has the function of classifying samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers, M2 can separate suspicious samples and benign samples of all categories.

[0050] Step 5) Determine the target category of the backdoor attack based on the potential representation similarity:

[0051] The suspicious sample set corresponding to each category and benign sample set The feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the feature vector of each sample is calculated. The mean of all corresponding latent representations Cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack;

[0052] The mean of all potential representations described in this step Cosine similarity of The calculation formula is:

[0053]

[0054] Among them, · represents vector multiplication operation, ||·|| represents modulus operation;

[0055] The anomaly detection of cosine similarity of all categories described in this step is implemented as follows:

[0056] Sort the cosine similarities of all categories in ascending order, and calculate the low threshold through the first quartile Q1 and the third quartile Q3 Then the cosine similarity and satisfy The categories are selected as the target categories of backdoor attacks, among which The calculation formula is:

[0057]

[0058] In this step, the potential representations corresponding to the suspicious sample set and the benign sample set are obtained to obtain the target category of the backdoor attack, and the suspicious sample set is also obtained for step 6). The corresponding latent representation mean Improved backdoor defense efficiency, significantly improving defense effectiveness through further analysis of potential vulnerabilities;

[0059] Step 6) Get the convolutional neural network backdoor defense results:

[0060] Suspicious sample set corresponding to the target category attacked by backdoor Iteratively train the convolutional neural network M1 with the backdoor implanted to obtain the convolutional neural network M3 with the backdoor eliminated.

[0061] In this step, the convolutional neural network M1 implanted with the backdoor is iteratively trained, wherein the suspicious sample set corresponding to the target category of the backdoor attack is calculated. The loss value L for each sample COS , is implemented using the cosine loss function, and the calculation formula is:

[0062]

[0063] Among them, μ trepresents the potential representation extracted from the t-th sample input M1, μ b Suspicious sample set representing the target category of backdoor attack The corresponding latent representation mean

Claims

1. A convolutional neural network backdoor defense method based on potential representation similarity, characterized in that: The steps include: (1) Obtain training sample set: The first training sample set D is composed of N images containing Y categories and some images in one category have backdoor triggers and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y≥2, N≥500, A≥500; (2) Iterative training of convolutional neural network: Through the first training sample set D train Iteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted; (3) Iterative training of the convolutional neural network with the backdoor implanted: Through the second training sample set D clean Iteratively train the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers; (4) Select category sample set: The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, we select T images with the smallest loss value and T images with the largest loss value from each category of samples to form a suspicious sample set. Benign sample set (5) Determine the target category of the backdoor attack based on the similarity of potential representations: The suspicious sample set corresponding to each category and benign sample set The feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the feature vector of each sample is calculated. The mean of all corresponding latent representations The cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack; (6) Obtain the convolutional neural network backdoor defense results: Suspicious sample set corresponding to the target category attacked by backdoor The convolutional neural network M1 with the backdoor implanted is iteratively trained to obtain the convolutional neural network M3 with the backdoor eliminated.

2. The method according to claim 1, characterized in that The convolutional neural network M0 described in step (2) includes a stacked input layer, multiple convolutional layers and a fully connected layer, and a maximum pooling layer is loaded between adjacent convolutional layers.

3. The method according to claim 1, characterized in that The iterative training of the convolutional neural network M0 described in step (2) is implemented as follows: (2a) The number of initial iterations is k, the maximum number of iterations is K, K ≥ 100, and the weight of the convolutional neural network at the kth iteration is W k , and let k = 1, M' = M0; (2b) The convolutional neural network M' performs forward propagation on the first training sample to obtain the output probability distribution P of each first training sample n And the corresponding true category probability distribution Q n ; (2c) Adopt the cross entropy loss function and output the probability distribution P n And the corresponding true category probability distribution Q n Calculate the loss value L for each first training sample CE , and then use the stochastic gradient descent method to pass L CE To W k Update to get the convolutional neural network M after this iteration k ; (2d) Determine whether k = K. If so, obtain the trained convolutional neural network M1. Otherwise, set k = k + 1, M' = M k , and execute step (2b).

4. The method according to claim 3, characterized in that The loss value L of each first training sample described in step (2c) CE , the calculation formula is: Here, ∑ represents a summation operation.

5. The method according to claim 3, characterized in that: The step (2c) described in W k Update, the update formula is: Among them, η represents the learning rate, W k+1 W k The updated results, Represents the partial derivative operation.

6. The method according to claim 1, characterized in that The convolutional neural network M1 with the backdoor implanted in step (3) is iteratively trained, wherein the loss value L of each second training sample is calculated. KL , is implemented using the KL divergence loss function, and the calculation formula is: Among them, P y Indicates that the Y value is The probability vector of .

7. The method according to claim 1, characterized in that The loss value L of each class sample described in step (4) CE , the calculation formula is:

8. The method according to claim 1, characterized in that The mean of all potential representations described in step (5) The cosine similarity of The calculation formula is: Among them, · represents vector multiplication operation, and ||·|| represents modulus operation.

9. The method according to claim 1, characterized in that: The anomaly detection of cosine similarity of all categories described in step (5) is implemented as follows: Sort the cosine similarities of all categories in ascending order, and calculate the low threshold through the first quartile Q1 and the third quartile Q3 Then the cosine similarity and satisfy The categories are selected as the target categories of backdoor attacks, among which The calculation formula is:

10. The method according to claim 1, characterized in that The convolutional neural network M1 implanted with the backdoor is iteratively trained as described in step (6), wherein the suspicious sample set corresponding to the target category of the backdoor attack is calculated. The loss value L for each sample COS , is implemented using the cosine loss function, and the calculation formula is: Among them, μ t represents the potential representation extracted from the t-th sample input M1, μ b Suspicious sample set representing the target category of backdoor attack The corresponding latent representation mean .

Images