A backdoor defense method for convolutional neural networks based on latent representation similarity

Abstract

This paper proposes a convolutional neural network backdoor defense method based on latent representation similarity. The implementation steps are as follows: obtaining a training sample set; iteratively training the convolutional neural network; iteratively training the convolutional neural network with a backdoor implanted; selecting a category sample set; determining the target category of the backdoor attack based on the latent representation similarity; and obtaining the convolutional neural network backdoor defense results. This method extracts the latent representations of suspicious and benign sample sets and uses the similarity between them to determine the target category of the backdoor attack, thereby improving the effectiveness and versatility of the defense and ensuring the security of the convolutional neural network. Furthermore, by designing a specific loss function, a backdoor-eliminating convolutional neural network is trained from the backdoored convolutional neural network, reducing computational overhead and improving defense efficiency. The method is particularly effective and applicable when applied to large-scale datasets.

Description

Technical Field

[0001] The present invention belongs to the field of neural network security technology and relates to a convolutional neural network backdoor defense method, specifically a defense method for convolutional neural network backdoor attacks, which can be applied to autonomous driving, face recognition, finance, chemistry, biology and other fields. Background Art

[0002] Convolutional neural networks (CNNs) are a key architecture in deep learning and are widely used in various computer vision tasks. In practical applications, CNNs are widely used in areas such as image classification, object detection, image segmentation, and face recognition. For example, the facial recognition technology in modern smartphones relies on CNNs to accurately extract and match facial features. Autonomous driving vision systems utilize CNNs to identify road signs, pedestrians, and vehicles. In the medical field, CNNs are used to analyze medical images, detect lesions in X-rays and CT scans, and assist doctors in diagnosis. CNNs are also applied to tasks such as text classification, sentiment analysis, and speech recognition in natural language processing. In recent years, the development of CNNs has continued to evolve. Classic models such as VGGNet, ResNet, and Inception have all introduced innovations in structural design, improving model performance and computational efficiency. Furthermore, combined with transfer learning techniques, CNNs can be effectively trained on small datasets, reducing the reliance on large amounts of labeled data. With the emergence of new technologies and the optimization of network architectures, the application prospects of CNNs remain broad, driving breakthroughs in deep learning and artificial intelligence in even more fields.

[0003] With the widespread application of convolutional neural networks, their existing problems have also attracted widespread attention. Research has shown that convolutional neural networks are vulnerable to a data poisoning attack called backdoor attacks. This attack is caused by a malicious adversary inserting a backdoor during the training of the convolutional neural network. Backdoor samples are generated by inserting pre-designed triggers into a portion of clean samples. These backdoor samples are then mixed with other clean samples to form a training dataset. The convolutional neural network trained on this untrusted dataset can maintain its ability to classify normal samples while demonstrating the ability to classify samples with specific triggers, namely backdoor samples, into malicious categories specified by the adversary. The adversary can exploit this backdoor to initiate malicious actions. Therefore, backdoor attacks pose a serious security risk to convolutional neural networks. Defenses against backdoor attacks on convolutional neural networks are extremely important and meaningful.

[0004] The existing convolutional neural network backdoor defense process is generally as follows: the defender uses the behavior of backdoor samples that differ from normal samples during training to separate suspicious backdoor samples, and then uses the remaining benign samples to retrain a clean and backdoor-free convolutional neural network. The effectiveness of convolutional neural network backdoor defense is evaluated by the backdoor attack success rate and model classification accuracy. A low backdoor attack success rate and a high model classification accuracy indicate the effectiveness of the backdoor defense method. For example, Zhejiang University disclosed a convolutional neural network backdoor defense method in its patent application "A Backdoor Defense Method and Device Based on Interpretable Neural Networks" (patent application number: CN202311356404.X, application publication number: CN117494112A). This technology obtains the activation values ​​of the neurons in the last convolutional layer of the input image and detects backdoor attacks by checking whether the activation values ​​are orthogonal. If a backdoor attack is detected, the attack-related neuron parameters are modified. An ensemble algorithm is used to train multiple feature extractors to enhance robustness. The image is then fed into these multiple feature extractors and the combined results are used for classification to protect against backdoor attacks. This technology improves both the accuracy of image classification and the security of the classification results. However, this backdoor defense method uses an ensemble algorithm and requires training multiple feature extractors, resulting in high computational overhead and resource consumption, making it inefficient when applied to large-scale datasets. Furthermore, this method has weak defense capabilities against covert backdoor attacks, with unstable results and no guarantee of effectiveness. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and propose a convolutional neural network backdoor defense method based on potential representation similarity to solve the technical problems of weak defense capability against hidden backdoor attacks and low backdoor defense efficiency in the prior art.

[0006] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0007] (1) Obtain training sample set:

[0008] The first training sample set D is composed of N images containing Y categories, one of which contains some images with backdoor triggers, and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y ≥ 2, N ≥ 500, A ≥ 500;

[0009] (2) Iterative training of convolutional neural network:

[0010] Through the first training sample set D trainIteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted;

[0011] (3) Iterative training of the convolutional neural network with the backdoor implanted:

[0012] Through the second training sample set D clean Iteratively training the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers;

[0013] (4) Select category sample set:

[0014] The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, select T images with the smallest loss value and T images with the largest loss value in each category to form a suspicious sample set Benign sample set

[0015] (5) Determining the target category of backdoor attacks based on potential representation similarity:

[0016] The suspicious sample set corresponding to each category and benign sample set The feature extraction is performed as the input of the convolutional neural network M1 implanted with the backdoor, and the feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the The mean of all corresponding latent representations Cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack;

[0017] (6) Obtaining the convolutional neural network backdoor defense results:

[0018] Suspicious sample sets corresponding to the target categories attacked by backdoors The convolutional neural network M1 with the backdoor implanted is iteratively trained to obtain the convolutional neural network M3 with the backdoor eliminated.

[0019] Compared with the prior art, the present invention has the following advantages:

[0020] (1) In the stage of determining the target category of the backdoor attack, the present invention extracts the potential representations corresponding to the suspicious sample set and the benign sample set, and uses the similarity between the two to determine the target category of the backdoor attack. On this basis, the potential representations are further analyzed to obtain the target category information, avoiding the instability caused by the direct reliance on potential representations to determine whether a backdoor attack exists in the prior art. This method significantly improves the effectiveness and versatility of the defense and ensures the security of the convolutional neural network.

[0021] (2) This paper designs a specific loss function and uses target category information to train a backdoor-free convolutional neural network from a backdoored convolutional neural network, avoiding the need for additional feature extractors to assist in backdoor defense. This method effectively reduces the computational overhead of the defense process and significantly improves defense efficiency, demonstrating greater efficiency and applicability, particularly when processing large-scale datasets. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart for implementing the present invention. DETAILED DESCRIPTION

[0023] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] Reference Figure 1 , the present invention comprises the following steps:

[0025] Step 1) Obtain the training sample set:

[0026] The first training sample set D is composed of N images containing Y categories, one of which contains some images with backdoor triggers, and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y ≥ 2, N ≥ 500, A ≥ 500;

[0027] In this embodiment, Y=2, N=50000, and A=500 are selected;

[0028] The backdoor trigger in this step is carefully designed by the attacker and embedded in the training data, so that the model outputs the attacker's preset target result when facing this specific trigger, while still behaving normally under normal input conditions;

[0029] Step 2) Iteratively train the convolutional neural network:

[0030] Through the first training sample set D train Iteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted;

[0031] The convolutional neural network M0 described in this step includes a stacked input layer, multiple convolutional layers and a fully connected layer, and a maximum pooling layer is loaded between adjacent convolutional layers;

[0032] The iterative training of the convolutional neural network M0 described in this step is implemented as follows:

[0033] (2a) The number of initial iterations is k, the maximum number of iterations is K, K ≥ 100, and the weight of the convolutional neural network in the kth iteration is W k , and let k = 1, M' = M0;

[0034] (2b) The convolutional neural network M' performs forward propagation on the first training sample to obtain the output probability distribution P of each first training sample n And the corresponding true category probability distribution Q n ;

[0035] (2c) uses the cross entropy loss function and outputs the probability distribution P n And the corresponding true category probability distribution Q n Calculate the loss value L for each first training sample CE , and then use the stochastic gradient descent method to pass L CE To W k Update and get the convolutional neural network M after this iteration k , where L CE and W k The calculation formulas for updating are:

[0036]

[0037]

[0038] Among them, ∑ represents the summation operation, η represents the learning rate, and W k+1 W k The updated results, Represents the partial derivative operation;

[0039] (2d) Determine whether k = K. If so, obtain the trained convolutional neural network M1. Otherwise, let k = k + 1, M' = M k , and execute step (2b);

[0040] Step 3) Iteratively train the convolutional neural network with the backdoor implanted:

[0041] Through the second training sample set D cleanIteratively training the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers;

[0042] The iterative training of the convolutional neural network M1 implanted with the backdoor in this step is similar to that in step 2, where the loss value L of each second training sample is calculated. KL , is implemented using the KL divergence loss function, and the calculation formula is:

[0043]

[0044] Among them, P y Indicates that the Y value is The probability vector of

[0045] Step 4) Select the category sample set:

[0046] The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, select T images with the smallest loss value and T images with the largest loss value in each category to form a suspicious sample set Benign sample set

[0047] The loss value L for each category sample described in this step CE , the calculation formula is:

[0048]

[0049] In this step, since the backdoor attack target class includes both clean images without backdoor triggers and images of other categories with backdoor triggers, and the convolutional neural network M2 has the function of classifying samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers, M2 can separate suspicious samples and benign samples of all categories.

[0050] Step 5) Determine the target category of the backdoor attack based on the potential representation similarity:

[0051] The suspicious sample set corresponding to each category and benign sample set The feature extraction is performed as the input of the convolutional neural network M1 implanted with the backdoor, and the feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the The mean of all corresponding latent representations Cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack;

[0052] The mean of all potential representations described in this step Cosine similarity of The calculation formula is:

[0053]

[0054] Among them, · represents vector multiplication operation, ||·|| represents modulus operation;

[0055] The steps for anomaly detection of cosine similarity of all categories described in this step are as follows:

[0056] Sort the cosine similarities of all categories in ascending order, and calculate the low threshold by the first quartile Q1 and the third quartile Q3 Then the cosine similarity and satisfy The categories are selected as the target categories of backdoor attacks, among which The calculation formula is:

[0057]

[0058] In this step, the potential representations corresponding to the suspicious sample set and the benign sample set are obtained to obtain the target category of the backdoor attack, and the suspicious sample set is also obtained for step 6). The corresponding latent representation mean Improved backdoor defense efficiency, significantly improving defense effectiveness through further analysis of potential vulnerabilities;

[0059] Step 6) Obtain the convolutional neural network backdoor defense results:

[0060] Suspicious sample sets corresponding to the target categories attacked by backdoors Iteratively train the convolutional neural network M1 with the backdoor implanted to obtain the convolutional neural network M3 with the backdoor removed.

[0061] In this step, the convolutional neural network M1 with the backdoor implanted is iteratively trained, where the suspicious sample set corresponding to the target category of the backdoor attack is calculated. The loss value L for each sample COS , is implemented using the cosine loss function, and the calculation formula is:

[0062]

[0063] Among them, μ trepresents the potential representation extracted from the t-th sample input M1, μ b Suspicious sample set representing the target category of backdoor attack The corresponding latent representation mean

Claims

1. A convolutional neural network backdoor defense method based on potential representation similarity, characterized in that: The steps include: (1) Obtain training sample set: The first training sample set D is composed of N images containing Y categories, one of which contains some images with backdoor triggers, and their category labels. train , the A images containing Y categories and without backdoor triggers and their category labels form the second training sample set D clean , where Y ≥ 2, N ≥ 500, A ≥ 500; (2) Iterative training of convolutional neural network: Through the first training sample set D train Iteratively train the convolutional neural network M0 to obtain the convolutional neural network M1 with a backdoor implanted; (3) Iterative training of the convolutional neural network with the backdoor implanted: Through the second training sample set D clean Iteratively training the convolutional neural network M1 implanted with the backdoor to obtain a convolutional neural network M2 that can classify samples with backdoor triggers in the first training sample set but cannot classify samples without backdoor triggers; (4) Select category sample set: The first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation, and the loss value L of each category sample is calculated CE Then, select T images with the smallest loss value and T images with the largest loss value in each category to form a suspicious sample set Benign sample set (5) Determining the target category of backdoor attacks based on potential representation similarity: The suspicious sample set corresponding to each category and benign sample set The feature extraction is performed as the input of the convolutional neural network M1 implanted with the backdoor, and the feature vector of each sample output by the last convolutional layer in M1 is used as the potential representation, and then the The mean of all corresponding latent representations Cosine similarity of Then perform anomaly detection on the cosine similarity of all categories to obtain the target category of the backdoor attack; (6) Obtaining the convolutional neural network backdoor defense results: Suspicious sample sets corresponding to the target categories attacked by backdoors The convolutional neural network M1 with the backdoor implanted is iteratively trained to obtain the convolutional neural network M3 with the backdoor eliminated.

2. The method according to claim 1, characterized in that The convolutional neural network M0 described in step (2) includes a stacked input layer, multiple convolutional layers and a fully connected layer, and a maximum pooling layer is loaded between adjacent convolutional layers.

3. The method according to claim 1, characterized in that The iterative training of the convolutional neural network M0 described in step (2) is implemented as follows: (2a) The number of initial iterations is k, the maximum number of iterations is K, K ≥ 100, and the weight of the convolutional neural network in the kth iteration is W k , and let k = 1, M' = M0; (2b) The convolutional neural network M' performs forward propagation on the first training sample to obtain the output probability distribution P of each first training sample n And the corresponding true category probability distribution Q n ; (2c) uses the cross entropy loss function and outputs the probability distribution P n And the corresponding true category probability distribution Q n Calculate the loss value L for each first training sample CE , and then use the stochastic gradient descent method to pass L CE To W k Update and get the convolutional neural network M after this iteration k ; (2d) Determine whether k = K. If so, obtain the trained convolutional neural network M1. Otherwise, let k = k + 1, M' = M k , and execute step (2b).

4. The method according to claim 3, characterized in that The loss value L of each first training sample described in step (2c) CE , the calculation formula is: Here, ∑ represents a summation operation.

5. The method according to claim 3, characterized in that The step (2c) described in W k Update, the update formula is: Among them, η represents the learning rate, W k+1 W k The updated results, Represents the partial derivative operation.

6. The method according to claim 1, wherein The convolutional neural network M1 with the backdoor implanted in step (3) is iteratively trained, wherein the loss value L of each second training sample is calculated. KL , is implemented using the KL divergence loss function, and the calculation formula is: Among them, P y Indicates that the Y value is The probability vector of .

7. The method according to claim 1, characterized in that The loss value L for each class sample described in step (4) CE , the calculation formula is: Among them, P n , Q n Respectively represent the first training sample set D train Each category sample is used as the input of the convolutional neural network M2 for forward propagation to obtain the output probability distribution of each first training sample and its corresponding true category probability distribution.

8. The method according to claim 1, characterized in that The mean of all potential representations described in step (5) Cosine similarity of The calculation formula is: Here, · represents vector multiplication operation, and ||·|| represents modulo operation.

9. The method according to claim 1, characterized in that The anomaly detection of cosine similarity of all categories described in step (5) is implemented as follows: Sort the cosine similarities of all categories in ascending order, and calculate the low threshold by the first quartile Q1 and the third quartile Q3 Then the cosine similarity and satisfy The categories are selected as the target categories of backdoor attacks, among which The calculation formula is:

10. The method according to claim 1, characterized in that The convolutional neural network M1 implanted with the backdoor is iteratively trained as described in step (6), wherein the suspicious sample set corresponding to the target category of the backdoor attack is calculated. The loss value L for each sample COS , is implemented using the cosine loss function, and the calculation formula is: Among them, μ t represents the potential representation extracted from the t-th sample input M1, μ b Suspicious sample set representing the target category of backdoor attack The corresponding latent representation mean

Images