Backdoor defense method based on trigger reconstruction
Through the method based on trigger reconstruction, the backdoor in the deep neural network is detected and removed, which solves the problem of backdoor removal affecting the accuracy of the model in the prior art, and achieves an efficient and secure backdoor defense effect.
Patent Information
- Application Number
- CN202411849440.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-16
- Publication Date
- 2025-04-29
AI Technical Summary
The prior art is difficult to effectively remove backdoors in deep neural networks, and conventional methods will affect the accuracy of the model or find more backdoors while removing backdoors.
A backdoor defense method based on trigger reconstruction is proposed, trigger reconstruction is carried out for each category through the objective function, triggers are cropped using model interpretability technology, backdoor triggers are distinguished from natural triggers using Logits analysis, and model backdoors are removed through adversarial training.
It improves the effect of backdoor detection and removal, enhances the security of the model, avoids the threat of backdoor attacks to model users, and maintains the high accuracy of the model.
Smart Images
Figure CN119903888A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the field of computer security, and in particular relates to a backdoor defense method based on trigger reconstruction. Background Art
[0002] In recent years, deep neural networks (DNNs) have achieved great success in many fields. However, many recent studies have shown that deep neural networks are vulnerable to backdoor attacks. Since the emergence of BadNets in 2017, which introduced the first backdoor attack in deep learning, deep neural network backdoor attack and defense technology has become a hot research direction. In the past seven years, a large number of backdoor attack and defense technologies have been proposed.
[0003] Backdoor attacks refer to the implantation of backdoors into models by modifying data sets or models. The backdoors can be triggered by triggers (a specific marker) so that the model outputs specific results, thereby achieving specific tasks or behaviors. A model with a successful backdoor embedded may pose a security threat to the users of the model. For example, a backdoor is embedded in a DNN model so that it misidentifies a stop sign with a trigger as a speed limit sign. If an autonomous vehicle is equipped with such a backdoor perception system, a fatal traffic accident may occur. In addition, backdoors are also hidden, and backdoor attacks can occur at various stages of model training, such as data collection, model training, model verification, model deployment, etc. It can be seen that backdoors are not only easy to embed, but also extremely harmful and hidden. Therefore, it is extremely important to defend against backdoor attacks.
[0004] Backdoor defense can prevent backdoor attacks by attackers before DNN generates erroneous outputs, thus avoiding backdoor risks. In recent years, although researchers have proposed many methods to defend against backdoor attacks, these methods either significantly affect the accuracy of the model in order to remove the backdoor, or can only defend models with fewer backdoors, which is not efficient enough. Therefore, it is urgent to propose new simple and effective backdoor removal methods to deal with the security threats caused by backdoor attacks. Summary of the invention
[0005] Purpose of the invention: In view of the problems existing in the above-mentioned background technology, the present invention proposes a backdoor defense method based on trigger reconstruction to improve the effect of backdoor detection and backdoor removal.
[0006] Invention content: The present invention discloses a backdoor defense method based on trigger reconstruction, comprising the following steps:
[0007] Given a backdoor model, a small number of clean samples are used to reconstruct the triggers for each category through the objective function, so that the model can classify all image samples with triggers attached as target labels;
[0008] Model interpretability technology is introduced to prune all reconstructed triggers to remove noise and obtain more realistic triggers;
[0009] Use Logits analysis to distinguish backdoor triggers from natural triggers;
[0010] A detection model is constructed by using the ineffectiveness of backdoor triggers on clean models and the effectiveness of natural triggers on similar models to distinguish between backdoor triggers and natural triggers.
[0011] Use the detected backdoor triggers to perform adversarial training to remove the model backdoor.
[0012] Furthermore, the objective function is as follows:
[0013] L inversion =L CE (f(x t ,y target ))+α·L CE (f(x',y true ))+β·L noise (m_tanh)
[0014]
[0015] x t =x*(1-m_tanh)+Δ*m_tanh)
[0016] x'=x*(1-m_tanh)
[0017] L noise (m_tanh)
[0018] =(∣m_tanh(i,j)-m_tanh(i+1,j+1)∣+∣m_tanh(i,j+1)-m_tanh(i
[0019] +1,j)∣+∣m_tanh(i,j)-m_tanh(i+1,j)∣+∣m_tanh(j,i)-m_tanh(j
[0020] +1,i)∣)
[0021] Where Δ is a 3D matrix with the same dimensions and color channels as the input image, representing the reconstructed trigger pattern, and m is a 2D matrix with the same shape as the input image, representing the trigger mask, with values ranging from 0 to 1. For a specific pixel (i, j), when m i,j = 1, the trigger completely covers the original color; and when m i,j=0, the pixel remains unchanged; Δ·m is the corresponding trigger, and the objective function consists of three loss terms, which are adjusted by two weights α and β. The weight β is dynamically adjusted according to the success rate of the trigger attack during the trigger reconstruction process;
[0022] Loss term L CE (f(x t ,y target )) is to optimize m and Δ to classify all image samples with triggers attached as target labels y target , L CE represents the cross entropy loss function; f(·) represents the prediction of the model; x t Represents an image sample with a trigger attached; y target represents the target label;
[0023] The second loss term L CE (f(x',y true )) is the correct classification of the image sample with the removed trigger into the true correct label y true , x' represents the image sample with the trigger removed; and y true Indicates the correct label of the sample;
[0024] The third loss term L noise (m_tanh) calculates the sum of the differences of adjacent elements of m_tanh, reducing the noise in the mask m_tanh and reducing the noise.
[0025] Furthermore, the introduction of model interpretability technology to prune all reconstructed triggers is implemented as follows:
[0026] A number of image samples are randomly selected and attached with reconstructed triggers. The image samples with attached triggers are input into the suspicious model, and the model interpretability technology is used to calculate the contribution value of each pixel to the model classification for each image, and the average contribution value is calculated. The pixels whose triggers contribute less to the classification are trimmed according to the average contribution value.
[0027] Furthermore, the method of trimming off pixels of the trigger that contribute less to the classification according to the average contribution value is as follows: a threshold t is defined to identify and remove pixels that contribute less to the classification; if the value on the average heat map is less than the threshold t, then these pixels are removed from the reconstructed trigger; the initial value of the threshold t is set to 1, and is reduced by 0.01 in each iteration, and the iterative process continues until the attack success rate of the operated trigger is just not less than the preset value.
[0028] Furthermore, the process of using Logits analysis to distinguish between backdoor triggers and natural triggers is as follows:
[0029] Uniformly sample from all available clean samples so that the number of samples in each category is equal, and input the sampled samples into the suspicious model to obtain the predicted logits value, and then perform statistical analysis; if the logits value of a label ranks in the top γ% among at least θ% of the sampled samples, the label is considered to be the backdoor target label; the value of θ is 25; the value of γ is 50.
[0030] Furthermore, the process of distinguishing between backdoor triggers and natural triggers is as follows:
[0031] First, some layers of the suspicious model are initialized, and then the initialized model is regarded as a student model, and the original suspicious model is used as a teacher model for knowledge distillation until the student model converges; the converged student model is the detection model; after the detection model is trained, the detection model is used to detect the validity of each reconstructed trigger; for a specific reconstructed trigger Trigger and a corresponding target label C, a small number of clean image samples are uniformly sampled from each category, while ensuring that these samples do not contain the category corresponding to the target label C; all sampled samples are attached with the reconstructed trigger Trigger and input into the suspicious model; if the trigger Trigger can effectively make the model misclassify the sample with the attached trigger Trigger as the target label C corresponding to the Trigger, then the trigger is considered to be a natural trigger, otherwise it is a backdoor trigger.
[0032] Furthermore, the knowledge distillation is:
[0033] L KD =α·L CE +(1-α)·T 2 ·L KL
[0034] Among them, L CE Calculate the cross entropy loss of the student model, L KL is the distillation loss function, which is used to calculate the difference between the output probability distribution of the student model and the teacher model; T is the distillation temperature; and the distillation temperature is 10.
[0035] Furthermore, the step of using the detected backdoor trigger to perform adversarial training to remove the model backdoor includes:
[0036] The detected backdoor triggers are attached to some clean images and correctly labeled; all available clean images and images with reconstructed backdoor triggers attached but correctly labeled are input into the model for fine-tuning to remove the backdoor.
[0037] Beneficial effects: Compared with the prior art, the beneficial effects of the present invention are: the present invention proposes a trigger reconstruction method with higher efficiency and quality, and uses model interpretability technology to trim triggers and remove redundant features, thereby further improving the effect of trigger reconstruction; in view of the problem that existing methods are difficult to detect many backdoors, logits analysis and two properties are used to identify backdoor triggers, thereby improving the detection accuracy; finally, the adversarial learning method is used to make the model "forget" the learned backdoor, so as to achieve the effect of removing the backdoor. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION
[0039] The present invention will be further described below in conjunction with the accompanying drawings.
[0040] like Figure 1 As shown, the present invention provides a backdoor defense method based on trigger reconstruction, which mainly includes trigger reconstruction, backdoor detection, and backdoor removal. When the present invention performs backdoor defense, it is required that each category has a small number of clean image samples. These clean samples are used for backdoor defense. The specific implementation process is as follows:
[0041] Step S1: trigger reconstruction.
[0042] Step S1.1, objective function design.
[0043] First of all, the present invention believes that the backdoor trigger should not change the semantics of the image. Because the goal of DNN is to output results that are consistent with human cognition. If the backdoor trigger changes the semantics of the image, even if the input into the model is recognized incorrectly, it should not be considered that the model has an error. For example, add a larger trigger (such as a rectangular pattern) to an image of a dog, blocking most of the dog's body so that the image cannot be recognized by the naked eye. Then, even if the model recognizes the trigger and classifies the dog as a cat, or a frog, a sailboat, etc., it is not considered that the model recognition is wrong. Therefore, for a backdoor sample containing a trigger, its semantics should not change after removing the trigger. A novel objective function is designed based on this.
[0044] In this embodiment, the objective function is as follows:
[0045] L inversion =L CE (f(x t ,y target ))+α·L CE (f(x',y true ))+β·L noise (m_tanh)
[0046]
[0047] x t =x*(1-m_tanh)+Δ*m_tanh)
[0048] x'=x*(1-m_tanh)
[0049] L noise (m_tanh)
[0050] =(∣m_tanh(i,j)-m_tanh(i+1,j+1)∣+∣m_tanh(i,j+1)-m_tanh(i
[0051] +1,j)∣+∣m_tanh(i,j)-m_tanh(i+1,j)∣+∣m_tanh(j,i)-m_tanh(j
[0052] +1,i)∣)
[0053] Among them, Δ is a 3D matrix with the same dimension and the same color channel as the input image, representing the pattern of the reconstructed trigger, and m is a 2D matrix with the same shape as the input image, representing the mask of the trigger. They are the two variables we need to optimize. The multiplication of the corresponding elements of the two variables Δ·m is the corresponding trigger. The objective function consists of three loss terms, which are adjusted by two weights α and β. Among them, the weight β is dynamically adjusted according to the success rate of the trigger attack during the trigger reconstruction process.
[0054] The first loss term L CE (f(x t ,y target )) In CE represents the cross entropy loss function; f(·) represents the prediction of the model; x t Represents an image sample with a trigger attached; y target represents the target label. The purpose of the first loss term is to optimize m and Δ to classify all image samples with triggers attached as target labels y target .
[0055] The second loss term L CE (f(x',y true )), x' represents the image sample with the trigger removed; and y true Represents the correct label of the sample. The purpose of the second loss term is to correctly classify the image sample with the removed trigger into the true correct label y true .
[0056] The third loss term L noise(m_tanh) calculates the sum of the differences of adjacent elements of m_tanh. The purpose of this item is to reduce the noise in the mask m_tanh to achieve the purpose of reducing noise.
[0057] In addition, the present invention does not directly use the mask m to calculate the target function, but uses a tanh function to pull the values greater than 0.5 in m closer to 1 and the values less than 0.5 closer to 0, and then uses m_tanh to calculate the target function. The variable a controls the degree of pulling, and the larger a is, the closer the value in m_tanh is to 0 or 1. The purpose of this item is to polarize the value of m.
[0058] Step S1.2, minimize the objective function and reconstruct the trigger.
[0059] This embodiment describes in detail how to reconstruct a trigger T corresponding to a specific label C. First, a small number of clean image samples are uniformly sampled from all categories except the category to which label C belongs to form a reconstruction dataset D. This step ensures the diversity of samples while avoiding samples directly related to the target label C to ensure the accuracy of trigger reconstruction.
[0060] Next, a small number of samples are selected from the dataset D each time and input into the model. Based on the output of the model, the objective function is calculated. This embodiment uses the gradient back propagation algorithm to optimize the value of the trigger pattern Δ and the mask m to minimize the objective function. By accurately adjusting Δ and m, a trigger that can manipulate the model to misclassify the image sample as label C can be effectively reconstructed.
[0061] During the optimization process, one batch is processed at a time and this process is repeated. After several rounds of optimization (such as 100 rounds), the product of Δ and m_tanh (the mask m processed by the tanh function) is the final trigger T. This product multiplies the corresponding elements to form a trigger pattern that can affect the model classification decision.
[0062] Finally, repeat the above steps until the triggers corresponding to all tags are reconstructed. This process ensures that each tag has a corresponding trigger, which provides a basis for subsequent backdoor defense.
[0063] Step S1.3: Model interpretability technique pruning triggers.
[0064] After step S1.2, the preliminary triggers have been reconstructed. However, some triggers still contain noise. These noises will affect the accuracy of subsequent backdoor detection. Therefore, model interpretability technology (such as Grad-CAM) is introduced to trim all reconstructed triggers to remove noise (redundant features).
[0065] The following is a detailed description of the reconstruction trigger pruning process corresponding to a specific label C.
[0066] Similarly, a small number of clean image samples are uniformly sampled from all categories except the category to which label C belongs to form a dataset D. Then, a number of image samples (such as 100) are randomly selected from dataset D, and the trigger Trigger is attached to these images. Subsequently, these image samples with the trigger attached are input into the model. The model interpretability technique is then used to calculate the contribution of each pixel to the model classification as C for each image, and the average of these contribution values is calculated. This step reveals which pixels have a significant impact on the model's classification decision.
[0067] Based on the calculated average contribution value, pixels that contribute less to the classification are removed. Specifically, a threshold t is defined to identify and remove pixels that contribute less to the classification. If the value on the average heat map is less than the threshold t, then these pixels will be removed from the reconstructed trigger. The initial value of the threshold t is set to 1 and is reduced by 0.01 in each iteration. This iterative process continues until the attack success rate of the manipulated trigger is just not less than a certain value (such as 95%). This condition ensures the effectiveness of the trigger while removing unnecessary noise.
[0068] Finally, repeat the above steps until all triggers corresponding to the labels are cropped using Grad-CAM.
[0069] Through the above steps, the trigger can be effectively reconstructed and the noise can be removed, providing a more accurate and reliable foundation for subsequent backdoor detection and defense.
[0070] Step S2: backdoor detection.
[0071] Step S2.1, Logits analysis.
[0072] When Logits analysis detects backdoor target labels, it first uniformly samples from all available clean samples to ensure that the number of samples in each category is equal to maintain the representativeness and balance of the samples. Subsequently, these sampled samples are input into the model to obtain the model's predicted logits value for each sample.
[0073] By performing a careful statistical analysis of these logits values, we can identify those labels that rank in the top γ% of at least θ% of the sampled samples. Specifically, if the logits value of a label is abnormally high in enough samples, this indicates that the label may be a backdoor target label. The intuition of this analysis is based on the fact that in backdoor attacks, in order to ensure the success rate of the attack, attackers often use a large number of backdoor samples to train the model, and the backdoor samples usually share the same backdoor target label. Therefore, these backdoor samples will cause the logits values of the backdoor target label to be abnormally high. The values of γ and θ directly determine the effectiveness of the logits analysis. In this implementation, γ is 25% and θ is 50%.
[0074] Through Logits analysis, the present invention can effectively identify some backdoor target tags based on model prediction, and the trigger corresponding to the backdoor target tag is the backdoor trigger.
[0075] Step S2.2: Design a detection model using two properties to distinguish natural triggers from backdoor triggers
[0076] Both natural triggers and backdoor triggers have the same functionality: they can be attached to an image so that the model can classify it as the target label.
[0077] Two properties are used to distinguish the two, namely the ineffectiveness of backdoor triggers on clean models and the effectiveness of natural triggers on similar models. The first property: the ineffectiveness of backdoor triggers on clean models, which is an inherent limitation of backdoor triggers. For clean models, backdoors are definitely invalid because clean models do not contain backdoors. The second property is the effectiveness of natural triggers on similar models. Even in clean models that are not implanted with backdoors, natural backdoors may exist. These natural backdoors usually use strong natural features of the target label as triggers, which are referred to as natural triggers in the present invention. In the present invention, natural triggers refer to strong natural features learned from training data sets.
[0078] For two models with the same structure, if they are trained using similar training data sets, they will be similar in feature extraction capabilities. This is because the high consistency of the model's structure and the training data leads to the similarity in feature extraction between the models. Therefore, the strong natural features extracted by the two models from the data set should be similar, which means that they have similar natural triggers. Based on this principle, the natural triggers of model A will also be effective on model B, which can cause model B to make incorrect classification decisions. Based on this, the present invention designs a detection model to detect backdoors using two properties. The detection model training process is as follows:
[0079] First, some layers of the backdoor model (such as the last fully connected layer) are initialized to obtain model B. The purpose of this step is to eliminate the strong correlation between the backdoor features and the backdoor target labels. The prediction results of the initialized model are no longer affected by the backdoor trigger.
[0080] Then, the original backdoor model A is used as the teacher model and model B is used as the student model for knowledge distillation. The samples used for knowledge distillation are all clean samples. The purpose of knowledge distillation is to improve the similarity between model B and model A. Using clean samples for distillation not only avoids the reconstruction of the backdoor, but also clean samples naturally carry natural triggers, so that the effectiveness of the model for natural triggers can be re-established. Compared with fine-tuning directly on clean data, knowledge distillation can make the student model more similar to the teacher model in the detection task, thereby further improving the effectiveness of natural triggers on the model. At the same time, using a higher distillation temperature during distillation can make the model output smoother, suppress the abnormally high logits of the backdoor target label caused by backdoor injection, and also suppress the overfitting phenomenon caused by fine-tuning on a small number of samples.
[0081] The knowledge distillation formula is as follows:
[0082] L KD =α·L CE +(1-α)·T 2 ·L KL
[0083] Among them, L CE Calculate the cross entropy loss of the student model, L KL is the KL divergence, which is used to calculate the difference between the output probability distribution of the student model and the teacher model; T is the distillation temperature.
[0084] A higher temperature can smooth the differences in the logits of each label of the student model, and can suppress the abnormally high logits of the backdoor target label caused by backdoor injection, and can also suppress overfitting; but the temperature cannot be too high. Too high a temperature will cause the output probability distribution of the student model to become very smooth, and the output probabilities of all categories will be close to the same, which will cause some important information to be lost and affect the effectiveness of the natural trigger on the student model B. Therefore, it is necessary to balance the two and choose a suitable temperature (such as temperature T is 10). Train model B until convergence. The converged model B is the final detection model.
[0085] After the detection model training is completed, start the detection. The specific steps are as follows:
[0086] For a specific trigger to be reconstructed Trigger and a corresponding target label C, we first uniformly sample a small number of clean image samples from each category, while ensuring that these samples do not contain the category corresponding to the target label C. Then, all sampled samples are attached with the reconstructed trigger Trigger and input into the model. If the trigger T can effectively make the model misclassify the sample with the attached trigger Trigger as the target label C corresponding to the Trigger, then the trigger is considered to be a natural trigger, otherwise it is a backdoor trigger. Effective here means that the attack success rate of the trigger Trigger is higher than the set threshold. The attack success rate threshold also directly determines the effectiveness of the detection model in detecting backdoor triggers, and it is recommended to be set to 10% here. That is, if the attack success rate of the reconstructed trigger is lower than 10%, it is considered to be a backdoor trigger.
[0087] Step S3, backdoor removal: After the backdoor detection is completed, the backdoor is removed based on the detected backdoor triggers.
[0088] Specifically, a certain proportion of samples are randomly selected from all available clean image sets. Subsequently, a backdoor trigger is randomly selected from the detected backdoor trigger, attached to any of the selected samples, and put back into the clean image library. In this process, ensure that the labels of the image samples with the trigger attached are accurately annotated. For example, a random image with the true label of cat is selected, and then the backdoor trigger is attached to this image and correctly annotated with the label of cat. The same is true for other categories such as dogs, ships, etc. This step will be repeated until all the extracted samples have triggers attached. Finally, the backdoor model is fine-tuned using this modified image sample set. If the available image set is small, it can be fine-tuned for several more rounds. The final fine-tuned model no longer contains the backdoor, and the accuracy rate drops very little, which has little impact on the performance of the model on the clean dataset.
[0089] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A backdoor defense method based on trigger reconstruction, characterized in that: The implementation process is as follows: Given a backdoor model, a small number of clean samples are used to reconstruct the triggers for each category through the objective function, so that the model can classify all image samples with triggers attached as target labels; Model interpretability technology is introduced to trim all reconstructed triggers to remove noise and obtain more realistic triggers; Use Logits analysis to distinguish backdoor triggers from natural triggers; A detection model is constructed by using the ineffectiveness of backdoor triggers on clean models and the effectiveness of natural triggers on similar models to distinguish between backdoor triggers and natural triggers. Use the detected backdoor triggers to perform adversarial training to remove the model backdoor.
2. According to claim 1, a backdoor defense method based on trigger reconstruction is characterized in that: The objective function is as follows: L inversion =L CE (f(x t ,y target ))+α·L CE (f(x',y true ))+β·L noise (m_tanh)) x t =x*(1-m_tanh)+Δ*m_tanh) x'=x*(1-m_tanh) L noise (m_tanh)=(∣m_tanh(i,j)-m_tanh(i+1,j+1)∣+∣m_tanh(i,j+1)-m_tanh(i+1,j)∣+∣m_tanh(i,j)-m_tanh(i+1,j)∣+∣m_tanh(j,i)-m_tanh(j+1,i)∣) Where Δ is a 3D matrix with the same dimensions and color channels as the input image, representing the reconstructed trigger pattern, and m is a 2D matrix with the same shape as the input image, representing the trigger mask, with values ranging from 0 to 1. For a specific pixel (i, j), when m i,j = 1, the trigger completely covers the original color; and when m i,j =0, the pixel remains unchanged; Δ·m is the corresponding trigger, and the objective function consists of three loss terms, which are adjusted by two weights α and β. The weight β is dynamically adjusted according to the success rate of the trigger attack during the trigger reconstruction process; Loss term L CE (f(x t ,y target )) is to optimize m and Δ to classify all image samples with triggers attached as target labels y target , L CE represents the cross entropy loss function; f(·) represents the prediction of the model; x t Represents an image sample with a trigger attached; y target represents the target label; The second loss term L CE (f(x',y true )) is the correct classification of the image sample with the removed trigger into the true correct label y true , x' represents the image sample with the trigger removed; and y true Indicates the correct label of the sample; The third loss term L noise (m_tanh) calculates the sum of the differences of adjacent elements of m_tanh, reducing the noise in the mask m_tanh and reducing the noise.
3. The backdoor defense method based on trigger reconstruction according to claim 1, characterized in that: The process of introducing the model interpretability technology to prune all reconstructed triggers is as follows: A number of image samples are randomly selected and attached with reconstructed triggers. The image samples with attached triggers are input into the suspicious model, and the model interpretability technology is used to calculate the contribution value of each pixel to the model classification for each image, and the average contribution value is calculated. The pixels whose triggers contribute less to the classification are trimmed according to the average contribution value.
4. The backdoor defense method based on trigger reconstruction according to claim 3 is characterized in that: The method of trimming off pixels of the trigger that contribute less to the classification based on the average contribution value is as follows: a threshold t is defined to identify and remove pixels that contribute less to the classification; if the value on the average heat map is less than the threshold t, then these pixels are removed from the reconstructed trigger; the initial value of the threshold t is set to 1, and is reduced by 0.01 in each iteration, and the iterative process continues until the attack success rate of the operated trigger is just not less than the preset value.
5. The backdoor defense method based on trigger reconstruction according to claim 1 is characterized in that: The process of using Logits analysis to distinguish backdoor triggers from natural triggers is as follows: Uniformly sample from all available clean samples so that the number of samples in each category is equal, and input the sampled samples into the suspicious model to obtain the predicted logits value, and then perform statistical analysis; if the logits value of a label ranks in the top γ% among at least θ% of the sampled samples, the label is considered to be the backdoor target label.
6. The backdoor defense method based on trigger reconstruction according to claim 5, characterized in that: The value of θ is 25; the value of γ is 50.
7. The backdoor defense method based on trigger reconstruction according to claim 1, characterized in that: The process of distinguishing backdoor triggers from natural triggers is as follows: First, some layers of the suspicious model are initialized, and then the initialized model is regarded as a student model, and the original suspicious model is used as a teacher model for knowledge distillation until the student model converges; the converged student model is the detection model; after the detection model is trained, the detection model is used to detect the validity of each reconstructed trigger; for a specific reconstructed trigger Trigger and a corresponding target label C, a small number of clean image samples are uniformly sampled from each category, while ensuring that these samples do not contain the category corresponding to the target label C; all sampled samples are attached with the reconstructed trigger Trigger and input into the suspicious model; if the trigger Trigger can effectively make the model misclassify the sample with the attached trigger Trigger as the target label C corresponding to the Trigger, then the trigger is considered to be a natural trigger, otherwise it is a backdoor trigger.
8. The backdoor defense method based on trigger reconstruction according to claim 7 is characterized in that: The knowledge distillation is: L KD =α·L CE +(1-a)·T 2 ·L KL Among them, L CE Calculate the cross entropy loss of the student model, L KL is the distillation loss function, which is used to calculate the difference between the output probability distribution of the student model and the teacher model; T is the distillation temperature.
9. The backdoor defense method based on trigger reconstruction according to claim 8, characterized in that: The distillation temperature is 10.
10. The backdoor defense method based on trigger reconstruction according to claim 1, characterized in that: The step of using the detected backdoor trigger to perform adversarial training to remove the model backdoor includes: The detected backdoor triggers are attached to some clean images and correctly labeled; all available clean images and images with reconstructed backdoor triggers attached but correctly labeled are input into the model for fine-tuning to remove the backdoor.