Efficient defense method for poison attack of pre-training model in multi-modal scene
By pre-training the three-stage defense method of the model in multimodal scenarios, including cleaning poisoned data, introducing a random text pool for detoxication and fine-tuning of external clean data, the problems of poor anti-toxicity effect, loss of model performance, and low training efficiency in the existing technology are solved, and efficient poisoning attack defense and model accuracy are achieved.
Patent Information
- Application Number
- CN202510075096.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-17
- Publication Date
- 2025-04-25
AI Technical Summary
The defense method of pre-training model poisoning attack in multimodal scenarios has defects such as poor detoxication effect, loss of model performance, and low training efficiency.
Three-stage defense method is adopted: the first stage is to clean the poisoned data by calculating the cosine distance of the graphic pairs before model training; the second stage is to introduce a random text pool to detoxicate; the third stage is to fine-tune by introducing external clean data after model training.
Effectively remove 50% poisoned samples from the training dataset, improve training efficiency, and improve the accuracy and defense effect of the model through post-fine-tuning.
Smart Images
Figure CN119884754A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of defense against poisoning attacks on deep learning models, and in particular to an efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios. Background Art
[0002] Multimodal models are widely used in many fields. For example, in the medical field, by combining medical imaging data of different modalities such as X-ray, CT, and MRI, multimodal models can more accurately identify lesions, analyze lesion characteristics, and assist doctors in early and accurate diagnosis of diseases, thereby improving the accuracy and efficiency of diagnosis. In the transportation field, by analyzing multimodal data such as traffic camera videos, road sensor data, and traffic flow information, multimodal models can monitor traffic flow and congestion in real time, predict traffic accident risks, and provide decision support for traffic management departments. In the field of information retrieval, multimodal models can provide support for accurate retrieval of applications such as recommendation systems and text-image mutual inquiry. To improve the accuracy of the model, most multimodal models are trained based on the CLIP pre-trained model.
[0003] However, this type of image and text pre-training model is very vulnerable to poisoning attacks. The attacker only needs to secretly add (<=1%) poisoned samples to the training set to manipulate the model's test results for specific inputs. There are currently two main poisoning attack methods:
[0004] The first method is poisoning. This is done by adding noise to the image. For example, adding noise with cat characteristics to a frog image to match it with frog category text, and then putting it into the training set to train with clean data, the model will be poisoned. Finally, in the inference stage, the model will be fed with a cat image and retrieve the corresponding frog text;
[0005] The second method is a backdoor attack. By adding a small trigger to the image and modifying the corresponding text pair, the trigger is associated with the corresponding text, and the model is poisoned by training it with clean data in the training set. Eventually, the poisoned model will associate the image with the trigger with the wrong text specified by the attacker.
[0006] In response to the above-mentioned poisoning threats, the more advanced defense methods in multimodal scenarios are as follows:
[0007] (1) The Clean-CLIP defense method proposed at the 2023 ICCV conference introduces a large amount of additional clean data to retrain the CLIP model to neutralize poisoned samples. However, some poisoned samples may still remain in the model and cannot be effectively detoxified.
[0008] (2) The ABL defense method proposed at the 2021 NeurIPS conference uses the idea of Machine Unlearning to make the trained model forget the specific poisoning training effects. However, the ABL algorithm may not be able to accurately identify poisoned data, resulting in invalid Unlearning and performance loss of the model.
[0009] (3) The RoCLIP defense method proposed at the 2023 NeurIPS conference replaces poisoned text data with clean text data by introducing additional clean text data. Although this method has a good detoxification effect, the large-scale text greatly reduces the training efficiency of the model.
[0010] In summary, the current defense methods for pre-trained models in multimodal scenarios have many defects such as poor detoxification effect, model performance loss, and low training efficiency. Summary of the invention
[0011] The technical problem to be solved by the present invention is: in view of the deficiencies of the above-mentioned prior art, an efficient defense method for pre-trained model poisoning attacks in multimodal scenarios is provided. In multimodal scenarios, while ensuring a high model accuracy, the pre-trained model poisoning attacks are successfully defended, and the defects of the existing defense methods such as poor detoxification effect, model performance loss after defense, and low training efficiency are solved.
[0012] In order to solve the above technical problems, the technical solution adopted by the present invention is: an efficient defense method for poisoning attacks on pre-trained models in multimodal scenarios, including three stages: the first stage is before model training, cleaning and filtering poisoned data in the training set; the second stage is during model training, using a random text pool for further detoxification; the third stage is after model training, introducing clean data for model fine-tuning; specifically including the following steps:
[0013] Step S1: Before model training, clean and filter the poisoned data in the training set;
[0014] Step S1.1: Select some image and text data from the training data set as a training subset;
[0015] Let the training data set be W and the training subset be W N ; The total number of image-text pairs in the training subset is N; the data in the training subset is poisoned; the training subset is recorded as W N The number of poisoned samples is m, and the number of clean samples is n, that is, N = m + n;
[0016] Step S1.2: Prepare the trained CLIP clean pre-trained model, and use the image and text encoders in the pre-trained model to map all the image-text pairs in the training subset into vectors; the clean sample vector is recorded as 1≤i≤n; the poisoned sample vector is recorded as 1≤j≤m;
[0017] Step S1.3: Calculate the cosine distance cos(·) of all image-text pairs in the training subset data. The calculation rule is shown in the following formula:
[0018]
[0019] Where D represents the dimension of the image and text vectors in the training subset data; T u represents the u-th text vector in the training subset; I u represents the u-th image vector in the training subset; T u with I u Constitute a picture-text pair, that is, the u-th sample in the training subset is recorded as X u (T u ,I u );
[0020] Step S1.4: Measure the “correlation” of the image and text by calculating the cosine distance of the image and text pair vectors of the training subset data; use the histogram to count the number of samples with the same cosine distance within the specified interval, and calculate the boundary threshold γ between the clean samples and the poisoned samples in the training subset data; when the cosine distance is higher than γ, it is considered to be a suspected poisoned sample;
[0021] The specific calculation of the boundary threshold γ between clean samples and poisoned samples is shown in the following formula:
[0022]
[0023] Where Z is the number of samples to be statistically calculated, which depends on the input parameters; Δ is the specified interval width, which defaults to 0.01; 1(·) is an indicator function, which is 1 if the condition is met, otherwise 0; α is a coefficient used to control the cosine value to be within the range of 0-1;
[0024] Step S1.5: Using the threshold value γ between clean samples and poisoned samples calculated in the training subset data, remove the data whose cosine distance between the image and text pairs in the training data is greater than the threshold value γ, and retain the data whose cosine distance is less than or equal to the threshold value γ, so as to finally obtain the detoxified training data set W ≤γ =WW >γ ;
[0025] Step S2: During model training, a random text pool is introduced to achieve efficient detoxification;
[0026] Step S2.1: Prepare the CLIP pre-trained model to be trained and initialize the parameters; initialize the text data in the random text pool, denoted as T pool, where the number of texts in the random text pool accounts for 2% of the training data set, denoted as N pool ; That is, N pool =2%*N;
[0027] Step S2.2: During the training of the CLIP pre-training model, a random text pool is introduced to participate in the training and the termination round δ is calculated;
[0028] (1) Using the training subset data W N , calculate the termination round δ;
[0029] The training subset data W N The text data in the random text pool is marked as flag=0; the text data in the random text pool is marked as flag=1; when epoch%K!=0, the model is trained using CLIP inter-modality contrast loss; epoch is the current training round; K is a hyperparameter, indicating that the random text pool is introduced in the Kth round for detoxification training, and the random text pool is not introduced in other rounds, and the model training is performed normally;
[0030] The CLIP inter-modality contrast loss function is shown in the following formula:
[0031]
[0032] Among them, τ is a hyperparameter;
[0033] (2) When the training round epoch%K==0, the random text pool data is introduced to participate in the training, and the feature vector of each image in the training subset is matched with the most similar text in the random text pool, instead of using the original text corresponding to the image in the training subset, so as to break the association between the poisoned image and text pairs;
[0034] Get the text data T in the random text pool pool The calculation method of the text most similar to the image feature vector in is as follows:
[0035] Calculate the text in the random text pool that is most similar to the feature vector of the image currently being trained, as shown in the following formula:
[0036]
[0037] Among them, T R is the feature vector I of the random text pool and the current training picture w Most similar texts;
[0038] The feature vector I in the random text pool and the current training picture w The most similar text vector T R The original text T corresponding to the images in the training subset wIn comparison, the text data that best matches the current image feature vector is retained as the text feature vector actually involved in training in this round, as shown in the following formula:
[0039] T current =argmin(T R ,‖I w -T w ‖2)
[0040] Among them, T current is the text vector actually involved in training in this round;
[0041] Using T current For the original text T in the training subset w Replace to achieve the purpose of detoxification; use the newly matched image and text to X(I w ,T current ) Perform CLIP inter-modality contrast loss training;
[0042] (3) After participating in this round of training, the text vector T that actually participated in the training current Update to the random text pool; count the number of times flag=1 text participates in training in each round, that is, update=count(flag=1); T needs to be updated again for each training pool The flags of the subset training data set are 1 and 0 respectively; when the number of poisoned samples is less than the set value, the current round is recorded as δ, as shown in the following formula:
[0043] δ=count(update)
[0044] The termination threshold δ is obtained by training the subset;
[0045] Step S2.3: Using the training dataset W ≤γ Retrain the CLIP pre-trained model; when epoch%K==0, introduce T pool For training, the other rounds use the training data set W ≤γ The original image-text pairs are trained; when count(update)<δ, T is not introduced in the subsequent training epochs pool Detoxify and only use the current image-text pair for CLIP inter-modality contrast loss training;
[0046] Step S3: After the model training is completed, external clean data is introduced, and inter-modality loss and intra-modality loss are used for fine-tuning to complete the training of the CLIP pre-trained model;
[0047] Introducing external clean data W newThe total number of image-text pairs is M, and the text and images are enhanced to fine-tune the CLIP pre-trained model. The fine-tuning loss includes the inter-modal loss L CLIP and the intra-modal loss L SS ; The intra-modal loss is shown in the following formula:
[0048]
[0049] in, and They represent the text and image after the image and text data is enhanced, and M is the external clean number W new The total number of image-text pairs in ;
[0050] The EDA method is used for text data enhancement; the AutoAugment method supported by the PyTorch framework is used for image data enhancement;
[0051] The final fine-tuned loss function L is shown in the following formula:
[0052] L=λ1L CLIP +λ2L ss
[0053] Among them, λ1 and λ2 are both hyperparameters.
[0054] The beneficial effect of adopting the above technical solution is that: the present invention provides an efficient defense method for poisoning attacks on pre-trained models in multimodal scenarios, which uses a boundary threshold to filter out 50% of the poisoned samples in the training data set, and uses an efficient random text pool for detoxification during the pre-training process, which can further remove the poisoned samples in the training set and improve the overall training efficiency. Post-fine-tuning detoxification can further compensate for the impact of the random text pool on the accuracy of the training model, and at the same time introduce external clean data to further improve the detoxification effect. BRIEF DESCRIPTION OF THE DRAWINGS
[0055] Figure 1 A three-stage framework diagram of an efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios provided by an embodiment of the present invention;
[0056] Figure 2 A general flow chart of an efficient defense method for poisoning attacks on pre-trained models in multimodal scenarios provided by an embodiment of the present invention;
[0057] Figure 3 A cosine distance distribution diagram of clean samples and poisoned samples before model training provided in an embodiment of the present invention;
[0058] Figure 4 A flow chart of efficient detoxification using a random text pool in model training provided by an embodiment of the present invention;
[0059] Figure 5 A line graph showing the proportion of clean samples and poisoned samples during the model training process provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0060] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.
[0061] In this embodiment, an efficient defense method for poisoning attacks on pre-trained models in multimodal scenarios is provided. Figure 1 As shown in the figure, it includes three stages: the first stage is before model training, cleaning and filtering the poisoned data in the training set; the second stage is during model training, using the random text pool for efficient detoxification; the third stage is after model training, introducing clean data for model fine-tuning; Figure 2 As shown, the specific steps include:
[0062] Step S1: Before model training, clean and filter the poisoned data in the training set;
[0063] Step S1.1: Select some image and text data from the training data set as a training subset;
[0064] Let the training data set be W and the training subset be W N ; The total number of image-text pairs in the training subset is N; the data in the training subset is poisoned; the number of poisoned data is 0.01% of the data in the training subset; the training subset is recorded as W N The number of poisoned samples is m, and the number of clean samples is n, that is, N=m+n; in this embodiment, the data set is selected: CC3M, and the device is Device: A100 graphics card;
[0065] Step S1.2: Prepare the trained CLIP clean pre-trained model, and use the image and text encoders in the pre-trained model to map all the image-text pairs in the training subset into vectors; the clean sample vector is recorded as 1≤i≤n; the poisoned sample vector is recorded as 1≤j≤m;
[0066] Step S1.3: Calculate the cosine distance cos(·) of all image-text pairs in the training subset data. The calculation rule is shown in the following formula:
[0067]
[0068] Where D represents the dimension of the image and text vectors in the training subset data; T u represents the u-th text vector in the training subset; I urepresents the u-th image vector in the training subset; T u with I u Constitute a picture-text pair, that is, the u-th sample in the training subset is recorded as X u (T u ,I u );
[0069] Step S1.4: According to the experimental phenomenon, the poisoned image-text pair vectors are not close in the initial training period. The "relevance" of the image-text is measured by calculating the cosine distance of the image-text pair vectors of the training subset data; experimental observations show that the distance between clean image-text pair vectors is closer, while the distance between poisoned image-text pair vectors is farther. Use a histogram to count the number of samples with the same cosine distance within a specified interval, such as Figure 3 As shown, the boundary threshold γ between clean samples and poisoned samples in the training subset data is calculated; when the cosine distance is higher than γ, it is considered to be a suspected poisoned sample;
[0070] The specific calculation of the boundary threshold γ between clean samples and poisoned samples is shown in the following formula:
[0071]
[0072] Among them, Z is the number of samples to be statistically calculated, and the number depends on the input parameters; Δ is the specified interval width, which defaults to 0.01; 1(·) is an indicator function, and the value is 1 if the condition is met, otherwise it is 0; α is a coefficient used to control the range of cosine values within 0-1; by traversing to find the specific position of the current sample cosine value in 0-1, α needs to be increased by 1 to locate the appropriate interval, and 1 is added if the cosine value meets the interval;
[0073] Step S1.5: Using the threshold value γ between clean samples and poisoned samples calculated in the training subset data, remove the data whose cosine distance between the image and text pairs in the training data is greater than the threshold value γ, and retain the data whose cosine distance is less than or equal to the threshold value γ, so as to finally obtain the detoxified training data set W ≤γ =WW >γ ;
[0074] In this embodiment, by using the limit threshold γ, most of the poisoned data can be removed before the pre-training begins, greatly reducing the impact of poisoned samples on the CLIP pre-training model - pre-training defense (cleaning and filtering of the training data set). The specific effect is shown in Table 1:
[0075] Table 1. Training data set cleaning and filtering results
[0076]
[0077] The experimental results in the table show that, under the premise of the same poisoning attack volume, cleaning and filtering the poisoned data before training can remove 75% of the poisoned sample pairs. At the same time, the attack success rate is greatly reduced, and the model accuracy is basically not affected.
[0078] Step S2: During the model training process, a random text pool is introduced to achieve efficient detoxification, such as Figure 4 As shown;
[0079] Although the data cleaning and filtering in the first stage can remove most of the poisoned sample pairs, there are still poisoned data in the training data that have not been removed. The final training results of the model will still be affected. Therefore, the second stage is based on the random text pool method to further remove the poisoned sample pairs that play a role in the pre-training process, and at the same time optimize the training process of introducing the random text pool to reduce the efficiency problem caused by the introduction of the random text pool.
[0080] Step S2.1: Prepare the CLIP pre-trained model to be trained and initialize the parameters; initialize the text data in the random text pool, denoted as T pool , where the number of texts in the random text pool accounts for 2% of the training data set, denoted as N pool ; That is, N pool =2%*N;
[0081] Step S2.2: During the training of the CLIP pre-training model, a random text pool is introduced to participate in the training and the termination round δ is calculated;
[0082] (1) Using the training subset data W N , calculate the termination round δ;
[0083] The training subset data W N The text data in the random text pool is marked as flag = 0; the text data T pool Marked as flag = 1; when epoch%K! = 0, the CLIP inter-modality contrast loss is used for model training; where epoch is the current training round; K is a hyperparameter, indicating that the random text pool is introduced in the Kth round for detoxification training, and the random text pool is not introduced in other rounds, and the model training is performed normally; in this embodiment, Batch Size = 64, Epoch = 30, K = 3, and the learning rate Lr = 0.0001;
[0084] The CLIP inter-modality contrast loss function is shown in the following formula:
[0085]
[0086] Among them, τ is a hyperparameter;
[0087] (2) When the training round epoch%K==0, the random text pool Pool data is introduced to participate in the training, and the feature vector of each image in the training subset is compared with the text data T in the random text pool pool The most similar text in the training subset is matched, instead of the original text corresponding to the image in the training subset, thus breaking the association between the poisoned image and text pairs;
[0088] Get the text data T in the random text pool pool The calculation method of the text most similar to the image feature vector in is as follows:
[0089] Calculate the text in the random text pool that is most similar to the feature vector of the image currently being trained, as shown in the following formula:
[0090]
[0091] Among them, T R is the feature vector I of the random text pool and the current training picture w Most similar texts;
[0092] The feature vector I in the random text pool and the current training picture w The most similar text vector T R The original text T corresponding to the images in the training subset w In comparison, the text data that best matches the current image feature vector is retained as the text feature vector actually involved in training in this round, as shown in the following formula:
[0093] T current =argmin(T R ,‖I w -T w ‖2)
[0094] Among them, T current is the text vector actually involved in training in this round;
[0095] Using T current For the original text T in the training subset w Replace to achieve the purpose of detoxification; use the newly matched image and text to X(I w ,T current ) Perform CLIP inter-modality contrast loss training;
[0096] (3) After participating in this round of training, the text vector T that actually participated in the training current Update to the random text pool; count the number of times flag=1 text participates in training in each round, that is, update=count(flag=1); T needs to be updated again for each training poolThe flags of the subset training data set are 1 and 0 respectively; when the number of poisoned samples is less than the set value, the current round is recorded as δ, as shown in the following formula:
[0097] δ=count(update)
[0098] The termination threshold δ is obtained through the subset;
[0099] Step S2.3: Using the training dataset W ≤γ Retrain the CLIP pre-trained model; the training method of introducing the random text pool is the same as step S2.2; when epoch%K==0, introduce T pool For training, the other rounds use the training data set W ≤γ The original image-text pairs are trained; when count(update)<δ, T is not introduced in the subsequent training epochs pool Detoxify and only use the current image-text pair for CLIP inter-modality contrast loss training;
[0100] In this embodiment, the data volume of the random text pool accounts for 2% of the entire data set. The data set used in this experiment is the CC3M data set, and the experimental environment is an A100 graphics card. After introducing the random text pool for training, the overall efficiency of the model has decreased. After observation, it was found that the epoch time of random text pool training increased significantly, and the time increased by about 0.5 times compared with the normal CLIP loss training.
[0101] In order to solve the problem of reduced efficiency, the present invention introduces a training early termination threshold to reduce the number of subsequent random text pool iterations and improve training efficiency. The specific method is as follows:
[0102] In this embodiment, the experiment is conducted on a subset of the training data set. 100M data is selected for the experiment, the poisoning ratio is 0.01%, and a total of 30 epochs are trained. The proportion of clean sample pairs and poisoned sample pairs corresponding to each epoch is counted, as shown in Figure 5 As shown in the figure, whether the main statistical graph and text pairs have changed under the effect of the random text pool.
[0103] from Figure 5 From the statistical results, we can find that after epoch=13, the poisoned sample pairs have been basically removed. It can be concluded that when the poisoned sample pairs have been basically removed, the iteration steps of the random text pool Pool participating in the training can be stopped in time, and only the basic training of CLIP can be performed, thereby improving efficiency.
[0104] The specific time to terminate the random text pool Pool's participation in training iteration can be calculated using the above δ calculation formula. Due to the characteristics of Pool iteration, if no more matching text pair is found in the Pool each time, the original text pair needs to be put into the text pool for update. After training epoch=13, the number of Pool updates is significantly reduced.
[0105] In this embodiment, the text in the Pool is marked as flag=1; the text in the original training data set is marked as flag=0; it is counted whether the text participating in the training each time is the data with flag=1 in the Pool or the data with flag=0; if flag=1, the total number of statistics is increased by 1, which proves that the data in the current text pool has replaced the original text, and it also indicates that it is currently in a detoxification state. Therefore, it is necessary to continue iterating. According to a large amount of statistical data, when the overall total number of updates is less than δ, the model has basically completed detoxification. In the actual training algorithm, the number of updates can be calculated and counted. When the number of updates is less than δ, it is judged that the poisoned samples have been removed, and only normal training of CLIP is required.
[0106] By using efficient random text pools to remove poisoning during pre-training, we can further remove poisoned samples in the training set and improve the overall training efficiency. The specific results are shown in Tables 2 and 3:
[0107] Table 2 Comparison of training time results (unit: seconds)
[0108] Model / Training Rounds 1 2 3 4 5 6 7 8 9 10 CLIP 10484 10574 10108 10601 10533 10646 10525 10505 10760 10546 RoCLIP 10457 10829 15002 10519 10822 16738 10597 11098 15192 10524 Model of the present invention 10811 10643 11098 10598 10801 11984 10879 10231 12002 10875
[0109] Table 3 Comparison of detoxification effects of defense methods
[0110]
[0111] Step S3: After the model training is completed, external clean data is introduced, and inter-modality loss and intra-modality loss are used for fine-tuning to complete the training of the CLIP pre-trained model;
[0112] Although the optimized random text pool solves the problem of training efficiency, the accuracy of the model after training is still reduced. To address this problem, the present invention conducts a third phase to fine-tune the pre-trained model by introducing clean training data to improve the accuracy of the model for benign samples.
[0113] Introducing external clean data W new The total number of image-text pairs is M, and the text and images are enhanced to fine-tune the CLIP pre-trained model. The fine-tuning loss includes the inter-modal loss L CLIP and the intra-modal loss L SS ; The intra-modal loss is shown in the following formula:
[0114]
[0115] in, and They represent the text and pictures after the image and text data is enhanced, and M is the external clean data W new The total number of image-text pairs in ;
[0116] The text data is enhanced using the EDA (Easy data augmentation) method; the image data is enhanced using the AutoAugment method supported by the PyTorch framework;
[0117] The final fine-tuned loss function L is shown in the following formula:
[0118] L=λ1L CLIP +λ2L ss
[0119] Among them, λ1 and λ2 are both hyperparameters.
[0120] The method of the present invention fine-tunes the detoxified pre-trained model by introducing a clean fine-tuning training data set. The use of intra-modal contrast loss can better improve the performance of the model and play a detoxifying role to a certain extent. At the same time, the fine-tuning clean data set is enhanced with graphic data, which can further improve the accuracy of the model and enhance the defense effect - post-training defense (clean data set fine-tuning model).
[0121] In this embodiment, post-fine-tuning detoxification can further compensate for the impact of the random text pool on the accuracy of the training model, and at the same time, external clean data is introduced to further improve the detoxification effect. The specific effects are shown in Table 4:
[0122] Table 4 Comparison of model accuracy and attack success rate
[0123]
[0124] From the current experimental results, it can be concluded that the defense method of the present invention can achieve a high BA (benign sample accuracy rate) while minimizing PSR (poisoning attack success rate) and BSR (backdoor attack success rate).
[0125] After training with the optimized random text pool method, it can be concluded through experimental results that the training efficiency of the defense method of the present invention is improved, and the defense effect can be achieved in a variety of data sets without affecting the performance of the model.
[0126] The specific experimental results of this embodiment may vary due to different experimental environments. If the experimental environment of the method of the present invention is configured, the experimental results closest to the effects of this embodiment can be obtained.
[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.
Claims
1. An efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios, characterized by: It includes three stages: the first stage is to clean and filter the poisoned data in the training set before model training; The second stage is to use the random text pool for further detoxification during model training; The third stage is to introduce clean data to fine-tune the model after model training.
2. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 1 is characterized in that: The following steps are involved: Step S1: Before model training, the poisoned data in the training set are cleaned and filtered through the boundary threshold of clean samples and poisoned samples; Step S2: During the model training process, a random text pool is introduced to participate in the model training to achieve efficient detoxification; Step S3: After the model training is completed, external clean data is introduced, and inter-modal loss and intra-modal loss are used for fine-tuning to complete the training of the CLIP pre-trained model.
3. The efficient defense method against poisoning attacks of pre-trained models in multimodal scenarios according to claim 2 is characterized in that: The step S1 comprises: Step S1.1: Select some image and text data from the training data set as a training subset; Let the training data set be W and the training subset be W N ; The total number of image-text pairs in the training subset is N; the data in the training subset is poisoned; the training subset is recorded as W N The number of poisoned samples is m, and the number of clean samples is n, that is, N = m + n; Step S1.2: Prepare the trained CLIP clean pre-trained model, and use the image and text encoders in the pre-trained model to map all the image-text pairs in the training subset into vectors; the clean sample vector is recorded as 1≤i≤n; the poisoned sample vector is recorded as 1≤j≤m; Step S1.3: Calculate the cosine distance cos(·) of all image-text pairs in the training subset data; Step S1.4: Measure the "correlation" of the image and text by calculating the cosine distance of the image and text pair vectors of the training subset data; use the histogram to count the number of samples with the same cosine distance within the specified interval, and calculate the boundary threshold γ between the clean samples and the poisoned samples in the training subset data; when the cosine distance is higher than γ, it is considered to be a suspected poisoned sample; Step S1.5: Using the threshold value γ between clean samples and poisoned samples calculated in the training subset data, remove the data whose cosine distance between the image and text pairs in the training data is greater than the threshold value γ, and retain the data whose cosine distance is less than or equal to the threshold value γ, so as to finally obtain the detoxified training data set W ≤γ =WW >γ .
4. The efficient defense method against poisoning attacks of pre-trained models in multimodal scenarios according to claim 3 is characterized in that: The calculation rule of step S1.3 for calculating the cosine distance cos(·) of all image-text pairs in the training subset data is as follows: Where D represents the dimension of the image and text vectors in the training subset data; T u represents the u-th text vector in the training subset; I u represents the u-th image vector in the training subset; T u with I u Constitute a picture-text pair, that is, the u-th sample in the training subset is recorded as X u (T u ,I u ).
5. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 4 is characterized in that: The specific calculation of the boundary threshold γ between the clean sample and the poisoned sample in step S1.4 is shown in the following formula: Among them, Z is the number of samples to be statistically calculated, and the number depends on the input parameters; Δ is the specified interval width, which defaults to 0.01; 1(·) is an indicator function, which is 1 if the condition is met, otherwise it is 0; α is a coefficient used to control the value range of the cosine value within 0-1.
6. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 5 is characterized in that: The step S2 comprises: Step S2.1: Prepare the CLIP pre-trained model to be trained and initialize the parameters; initialize the text data in the random text pool, denoted as T pool , where the number of texts in the random text pool accounts for 2% of the training data set, denoted as N pool ; That is, N pool =2%*N; Step S2.2: During the training of the CLIP pre-training model, a random text pool is introduced to participate in the training and the termination round δ is calculated; Step S2.3: Using the training dataset W ≤γ Retrain the CLIP pre-trained model; when epoch%K==0, introduce T pool For training, the other rounds use the training data set W ≤γ The original image-text pairs are trained; when count(update)<δ, T is not introduced in the subsequent training epochs pool To remove the toxin, only the current image-text pair is used for CLIP inter-modality contrast loss training.
7. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 6 is characterized in that: The step S2.2 comprises: (1) Using the training subset data W N , calculate the termination round δ; The training subset data W N The text data in is marked as flag = 0; the random text pool T pool The text data in is marked as flag = 1; when epoch%K! = 0, the CLIP inter-modality contrast loss is used for model training; epoch is the current training round; K is a hyperparameter, indicating that the random text pool is introduced in the Kth round for detoxification training, and the random text pool is not introduced in other rounds, and the model training is performed normally; The CLIP inter-modality contrast loss function is shown in the following formula: Among them, τ is a hyperparameter; (2) When the training round epoch%K==0, the random text pool T is introduced pool The data is used for training, and the feature vector of each image in the training subset is compared with the random text pool T pool The most similar text in the training subset is matched, instead of the original text corresponding to the image in the training subset, thus breaking the association between the poisoned image and text pairs; Get random text pool T pool The calculation method of the text most similar to the image feature vector in is as follows: Calculate the text in the random text pool that is most similar to the feature vector of the image currently being trained, as shown in the following formula: Among them, T R is the feature vector I of the random text pool and the current training picture w Most similar texts; The feature vector I in the random text pool and the current training picture w The most similar text vector T R The original text T corresponding to the images in the training subset w In comparison, the text data that best matches the current image feature vector is retained as the text feature vector actually involved in training in this round, as shown in the following formula: T current =argmin(T R ,‖I w -T w ‖2) Among them, T current is the text vector actually involved in training in this round; Using T current For the original text T in the training subset w Replace to achieve the purpose of detoxification; use the newly matched image and text to X(I w ,T current ) Perform CLIP inter-modality contrast loss training; (3) After participating in this round of training, the text vector T that actually participated in the training current Update to random text pool T pool Count the number of times flag=1 text participates in training in each round, that is, update=count(flag=1); T needs to be updated again for each training pool The flags of the subset training data set are 1 and 0 respectively; when the number of poisoned samples is less than the set value, the current round is recorded as δ, as shown in the following formula: δ=count(update) The termination threshold δ is obtained by training the subset.
8. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 7 is characterized in that: The step S3 comprises: Introducing external clean data W new , the total number of image-text pairs is M, and the text and images are enhanced to fine-tune the CLIP pre-trained model. The fine-tuning loss includes the inter-modal loss L CLIP and the intra-modal loss L SS ; The final fine-tuned loss function L is shown in the following formula: L=λ1L CLIP +λ2L ss Among them, λ1 and λ2 are both hyperparameters.
9. The efficient defense method against poisoning attacks on pre-trained models in multimodal scenarios according to claim 8, characterized in that: The intra-modal loss is expressed as follows: in, and They represent the text and image after the image and text data is enhanced, and M is the external clean number W new The total number of image-text pairs in .
10. The efficient defense method against poisoning attacks of pre-trained models in multimodal scenarios according to claim 8, characterized in that: In step S3, the text data is enhanced using the EDA method; Image data enhancement uses the AutoAugment method supported in the PyTorch framework.