Processing method and device for defending backdoor attack of natural language processing model

Abstract

The invention relates to the field of computer technology application, in particular to a processing method and device for natural language processing model backdoor attack defense. The method comprises the following steps: generating different views of a text sample by utilizing a data enhancement mode to carry out first-stage training on a natural language processing model, and carrying out second-stage training on the model by utilizing clean text data; the method can enable the model to learn important features of a text sample, neglect interference of small disturbance on sample content, destroy strong relation between a trigger constructed by an attacker and a target category, reduce interference of the trigger on model decision, enhance model robustness, ensure effective defense against backdoor attack, and improve the robustness of the trigger. And the performance of the model classification task is kept.

Description

Technical Field

[0001] The present invention relates to the field of computer technology applications, and particularly to a processing method and device for defending against backdoor attacks on natural language processing models. Background Art

[0002] With the wide use of artificial intelligence, deep neural networks are used for text data processing tasks. However, deep neural networks are vulnerable to various attacks, such as being vulnerable to data poisoning attacks during the data collection phase, being vulnerable to backdoor attacks during the model training phase, and being vulnerable to adversarial sample attacks during the model decision-making phase. Compared with data poisoning attacks and adversarial sample attacks, backdoor attacks have stronger concealment because the trigger is difficult to detect and the backdoor model still maintains normal performance for normal samples. At the same time, backdoor attacks can achieve a high attack success rate at a relatively low cost. The existing mainstream defense methods against text backdoor attacks can be divided into: defense methods for the training data set, defense methods for the model itself, and defense methods for the model input according to different defense objectives. The defense method for the data set mainly uses text feature difference analysis to detect and filter possible poisoned samples in the training data set to keep the training data set as clean as possible. However, this defense method focuses on large-scale training data, has a large computational overhead, and is prone to misdeleting samples, reducing the training effect of the model. To reduce the additional overhead caused by cleaning backdoor data, a defense method for the model itself is proposed, which mainly targets suspicious poisoned models and adjusts the model itself using ideas such as model pruning and trigger reconstruction to achieve the purpose of eliminating the backdoor. However, model pruning and trigger reconstruction may cause the performance of the model in completing the original classification task to deteriorate because the trained model is adjusted. To maintain the performance of the model itself as much as possible without modifying the trained model, a defense method for the model input is proposed, which uses the sensitivity of the model to the trigger to detect and filter the trigger of the text sample to ensure that the input sample does not carry a trigger that interferes with the model decision as much as possible. However, this defense method still has problems such as misdeleting clean samples and affecting the decision boundary, and the designed perturbation and determined threshold can only target a certain type of determined trigger, resulting in poor generalization. Summary of the Invention

[0003] In view of the above technical problems, the technical solution adopted by the present invention is as follows: According to a first aspect of the present invention, there is provided a processing method for defending against backdoor attacks on natural language processing models, the method comprising the following steps: S100, dividing the obtained original text data set into a first data set and a second data set.

[0004] S200. Perform data augmentation on the first data set to obtain an augmented data set of the first data set, and merge the first data set and the corresponding augmented data set as the first training data set.

[0005] S300. Use the first training data set to perform the first-stage training on the initial natural language processing model, and use the natural language processing model after the first-stage training as the intermediate model. The natural language processing model includes a data processing model and a prediction module. Among them, the data processing model includes an initial feature acquisition module, a feature weighting module, a classification marker feature acquisition module, a convolutional feature extraction module, a feature fusion module, and a feature mapping module. The initial feature acquisition module is respectively connected to the feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module. The feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module are also respectively connected to the feature fusion module. The feature fusion module, the feature mapping module, and the prediction module are connected in sequence.

[0006] S400. Use the second data set to perform the second-stage training on the intermediate model, and use the intermediate model after the second-stage training as the final natural language processing model.

[0007] According to the second aspect of the present invention, there is provided a processing device for defending against backdoor attacks on natural language processing models. The device includes: A data acquisition module for acquiring the original text data set and dividing the acquired original text data set into a first data set and a second data set.

[0008] A data augmentation module for performing data augmentation on the first data set to obtain an augmented data set of the first data set, and merging the first data set and the corresponding augmented data set as the first training data set.

[0009] A first training module for using the first training data set to perform the first-stage training on the initial natural language processing model, and using the natural language processing model after the first-stage training as the intermediate model. The natural language processing model includes a data processing model and a prediction module. Among them, the data processing model includes an initial feature acquisition module, a feature weighting module, a classification marker feature acquisition module, a convolutional feature extraction module, a feature fusion module, a feature mapping module, and a normalization processing module. The initial feature acquisition module is respectively connected to the feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module. The feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module are also respectively connected to the feature fusion module. The feature fusion module, the feature mapping module, and the normalization processing module are connected in sequence.

[0010] The second training module is used to perform the second-stage training on the intermediate model using the second dataset, and the intermediate model after the second-stage training is used as the final natural language processing model.

[0011] The present invention has at least the following beneficial effects: The processing method for backdoor attack defense of a natural language processing model provided by an embodiment of the present invention includes performing the first-stage training on the natural language processing model by generating different views of text samples using a data augmentation method and performing the second-stage training on the model using clean text data, which can enable the natural language processing model to learn important features of the text samples, ignore the interference of small perturbations on the sample content, break the strong connection between the trigger constructed by the attacker and the target category, reduce the interference of the trigger on the model decision, and can effectively defend against backdoor attacks while maintaining the performance of the model classification task by enhancing the model robustness.

[0012] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present invention, nor is it used to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0014] Figure 1 It is a flowchart of the processing method for backdoor attack defense of a natural language processing model provided by an embodiment of the present invention; Figure 2 It is a framework diagram of the natural language processing model provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0015] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts fall within the protection scope of the present invention.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this invention belongs. The terms used in the description of the present invention herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more of the associated listed items.

[0017] It should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts depict the steps as sequential processes, many of the steps can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the steps can be rearranged. The process can be terminated when its operations are completed, but it can also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0018] In some application scenarios, users will download pre-trained models from open-source websites in the hope of using the models for a certain classification task, such as a certain text data classification task. However, the pre-trained models cannot directly perform the classification task, and the users are unsure whether the pre-trained models have backdoor attacks. The goal of the users is to clear the backdoors of the models while fine-tuning the models to achieve the purpose of normally performing the classification task.

[0019] For the above application scenarios, embodiments of the present invention provide a processing method for defending against backdoor attacks in natural language processing models. The aim is to fine-tune and train a text classification model that may have a backdoor attack by using self-supervised contrast learning, generate different views of text samples through data augmentation, enable the model to learn important features of the text samples, ignore the interference of small perturbations on the sample content, break the strong connection between the trigger constructed by the attacker and the target category, reduce the interference of the trigger on the model decision-making, and achieve the defense effect of the model against the backdoor trigger of the text sample.

[0020] As Figure 1 shown, the processing method for defending against backdoor attacks in natural language processing models provided by embodiments of the present invention may include the following steps: S100, divide the obtained original text data set into a first data set and a second data set.

[0021] In the embodiments of the present invention, the original text data set can be an open-source data set, such as a news topic classification data set and a sentiment classification data set, etc.

[0022] S200, perform data augmentation processing on the first data set to obtain an augmented data set of the first data set, and merge the first data set and the corresponding augmented data set as the first training data set.

[0023] In an embodiment of the present invention, the enhanced dataset is a dataset obtained based on at least one data enhancement method, wherein one data enhancement method corresponds to one data contamination method.

[0024] In the backdoor attack of a deep neural network model, the trigger plays an important role. When the input sample of the poisoned model carries a trigger, the output classification label will become the label preset by the attacker. The direct reason for the success of the backdoor attack is that the attacker enables the backdoor model to learn the strong connection between the features of the trigger and the target label, causing it to misclassify the text with the trigger. The fundamental reason for the success of the backdoor attack is that among the features learned by the backdoor model, the features of the trigger dominate and have a greater impact on model classification.

[0025] In an embodiment of the present invention, data enhancement operations should consider various triggers that may be used in text domain backdoor attacks, and make the enhanced text as similar as possible to the real trigger on the premise of ensuring that the basic features of the original text are not greatly changed. The data contamination method can be obtained based on the statistics of the backdoor trigger types disclosed in the literature. In a schematic embodiment, the data enhancement method may include: (1) replacing some words in the original text data with synonyms; (2) inserting words at random positions in the sentences of the original text data; (3) inserting sentences at random positions in the sentences of the original text data; (4) back-translating the original text data in the English-Chinese-English manner, etc.

[0026] S300, performing a first-stage training on the initial natural language processing model using the first training dataset, and using the natural language processing model after the first-stage training as an intermediate model.

[0027] In an embodiment of the present invention, as Figure 2 shown, the natural language processing model may include a data processing model and a prediction module 7. Among them, the data processing model includes an initial feature acquisition module 1, a feature weighting module 2, a classification marker feature acquisition module 3, a convolutional feature extraction module 4, a feature fusion module 5, and a feature mapping module 6. Among them, the initial feature acquisition module 1 is respectively connected to the feature weighting module 2, the classification marker feature acquisition module 3, and the convolutional feature extraction module 4. The feature weighting module 2, the classification marker feature acquisition module 3, and the convolutional feature extraction module 4 are also respectively connected to the feature fusion module 5. The feature fusion module 5, the feature mapping module 6, and the prediction module 7 are connected in sequence.

[0028] S400, performing a second-stage training on the intermediate model using the second dataset, and using the intermediate model after the second-stage training as the final natural language processing model.

[0029] The processing method for backdoor attack defense of natural language processing models provided by the embodiments of the present invention uses data augmentation to generate different views of text samples for the first-stage training of natural language processing models and uses clean text data for the second-stage training of the models, enabling the models to learn important features of text samples, ignoring the interference of small perturbations to sample content, breaking the strong connection between the triggers constructed by attackers and target categories, reducing the interference of triggers to model decisions, and being able to effectively defend against backdoor attacks while enhancing the robustness of the models and maintaining the performance of model classification tasks.

[0030] Further, in the embodiments of the present invention, the initial feature acquisition module 1 includes a pre-trained encoder 101 and an initial feature fusion module 102. Among them, the initial feature fusion module is used to fuse multiple initial features obtained by the pre-trained encoder to obtain fused initial features and send them to the feature weighting module and the convolutional feature extraction module respectively.

[0031] In the embodiments of the present invention, the pre-trained encoder can be an encoder downloaded from an open-source website. For example, it can be a pre-trained BERT model, and this model may be a model implanted with a backdoor.

[0032] In the embodiments of the present invention, the fused initial feature FM may satisfy the following conditions: 。

[0033] Among them, h i is the output feature of the i-th layer of the pre-trained encoder, and LN(h i ) represents the feature obtained after layer normalization processing of h i , a i is the weight of the i-th layer of the pre-trained encoder, which is a learnable weight, and the value of i ranges from 1 to L, where L is the number of layers of the pre-trained encoder.

[0034] In the embodiments of the present invention, the output feature of each layer of the pre-trained encoder can be a tensor with dimensions of B×S×D. B is the number of text data to be encoded, which is the number of training data in each batch during the training stage and the number of text data received during the test stage. S is the sequence length of each text data, that is, the word segmentation result of each text data, and D is the feature dimension, that is, the feature dimension of each word, such as 768 dimensions, etc.

[0035] In the embodiments of the present invention, the classification marker feature acquisition module 3 is used to acquire the classification marker feature in the initial feature output by the last layer of the pre-trained encoder.

[0036] In an embodiment of the present invention, the classification label is the CLS token feature. A special token added at the start position of a sequence when a natural language processing model processes an input sequence, which is used to capture the global representation of the entire sequence. The CLS token feature in a pre-trained natural language processing model usually contains high-quality sequence representations, can provide text global feature representations for model training, reduce the dependence on local features, and thus reduce the impact of triggers on decision-making.

[0037] In an embodiment of the present invention, the feature weighting module 2 is used to perform a weighting process on the received fused initial features to obtain corresponding weighted features.

[0038] Further, the feature weighting module specifically performs the following steps: S10, perform a first linear transformation process on the received fused initial features to obtain a first feature.

[0039] Specifically, the first feature F1 satisfies the following condition: F1 = W1 × FM + b1. Where W1 is a learnable first weight and b1 is a first bias term.

[0040] S11, use a first activation function to perform an activation process on the first feature, and perform a second linear transformation process on the result of the activation process to obtain a second feature.

[0041] In an embodiment of the present invention, the first activation function can be the tanh activation function. Specifically, the second feature F2 satisfies the following condition: F2 = W2 × tanh(F1) + b2. Where W2 is a learnable second weight, b2 is a second bias term, and tanh(F1) represents performing an activation process on F1 using the tanh activation function.

[0042] S13, perform an attention masking operation on the second feature to obtain a corresponding masking operation result as the third feature.

[0043] In an embodiment of the present invention, the third feature F3 satisfies the following condition: F3 = F2 + (1 - M) × (-∞). Where M is a masking matrix with the same feature dimension as F2, the element values in M are 0 and 1. Among them, in M, the element value corresponding to the masked feature is 0, otherwise, it is 1. 1 - M represents performing an element-wise subtraction of the all-1 matrix and M.

[0044] S14, perform a weighted sum of the third feature and the received input features to obtain the weighted feature.

[0045] In an embodiment of the present invention, the weighted feature satisfies the following condition: Fa = ∑ n j=1 (FL j⊙H j ).

[0046] Among them, Fa is the weighted feature, and FL j is the eigenvalue of the j-th feature in the feature vector obtained by normalizing the third feature. The value range of j is from 1 to n, where n is the feature dimension of the feature vector obtained by normalizing the third feature. H j is the eigenvalue of the j-th feature in the initial fusion feature. ⊙ represents dot product, that is, FL j ⊙H j means multiplying the features corresponding to FL j element-wise with the features corresponding to H j and then summing them up.

[0047] In the embodiments of the present invention, the third feature can be normalized by the softmax() function.

[0048] Furthermore, in the embodiments of the present invention, the convolutional feature extraction module includes m convolutional units, and the convolutional kernel sizes of any two convolutional units are different. In a schematic embodiment, m = 3, that is, it includes 3 convolutional units. The convolutional kernel sizes of the 3 convolutional units can be 1, 3, and 5 in sequence, corresponding to the feature extraction of words, phrases, and sentences respectively.

[0049] The convolutional feature extraction module uses convolutions of multiple different sizes. The purpose is to be able to capture sequence patterns of different lengths, allow the model to simultaneously focus on local and global features of the text, improve the ability to capture complex language patterns, enable the model to understand the text content more comprehensively, facilitate reducing the dependence on trigger features in the decision-making process, and at the same time improve the performance of downstream tasks.

[0050] Furthermore, the output features of the convolutional feature extraction module are obtained through the following steps: S20, using the r-th convolutional unit to perform a convolution operation on the received initial fusion feature to obtain the convolution result of the r-th convolutional unit as the r-th convolution result; the value range of r is from 1 to m, and the initial value is 1.

[0051] Those skilled in the art know that the convolution operation of the convolutional unit can be an existing convolution method.

[0052] S21, sequentially performing activation and pooling processing on the r-th convolution result to obtain the corresponding processing result as the r-th convolution processing feature.

[0053] In the embodiments of the present invention, the ReLU activation function can be used to activate the convolution result. The pooling processing can be max pooling processing.

[0054] S22. Concatenate the m convolution-processed features as the output features of the convolution feature extraction module.

[0055] In the embodiment of the present invention, the feature fusion module 5 is used to concatenate the weighted feature, the classification marker feature, and the output features of the convolution feature extraction module, and use the obtained concatenation result as the fusion feature. The features in the fusion feature have more, more flexible, and richer feature perspectives, which can reduce the model's dependence on a single trigger feature during the decision-making process and can adapt to more types of tasks.

[0056] Furthermore, in the embodiment of the present invention, the feature mapping module is used to convert the received fusion feature into a more compact and discriminative representation. In the contrastive learning task, this representation should be able to better capture the semantic similarity between samples while maintaining the ability to distinguish different classes. In backdoor defense, it can reduce the time and computational resource overhead during the training process while maintaining the performance of the defense.

[0057] In the embodiment of the present invention, the feature mapping process is performed on the received fusion feature in a step-by-step compression manner, which can reduce the feature dimension while retaining as much useful information as possible. During the compression process, layer normalization, the ReLU activation function, and the dropout layer are used to help make the training more stable during feature mapping, enhance the model's generalization ability, and prevent overfitting. Finally, an L2 normalization operation is performed on the mapped features to output the extracted text features. The L2 normalization operation eliminates the scale difference between different samples and helps with the numerical stability of the model. Specifically, the output features of the feature mapping module are obtained through the following steps: S30. Perform a first mapping process on the received input features to obtain the first mapped features.

[0058] In the embodiment of the present invention, the first mapping process may include: Perform a first linear transformation process on the received input features to obtain the first linear transformation result.

[0059] Use the second activation function to process the first linear transformation result to obtain the first activation processing result.

[0060] In the embodiment of the present invention, the second activation function is the ReLU activation function.

[0061] Perform layer normalization on the first activation processing result to obtain the first mapped features.

[0062] Specifically, the first mapped feature FC1 can be expressed as: FC1 = LN(ReLU(W3 × FMM + b3)), where W3 is the learnable third weight, b3 is the third bias term, FMM is the fusion feature, LN() represents the layer normalization process, and ReLU() is the ReLU activation function.

[0063] S31. Perform a second mapping process on the first mapping feature to obtain a second mapping feature.

[0064] In the embodiment of the present invention, the second mapping process may include: Perform a linear transformation process on the first mapping feature to obtain a second linear transformation result.

[0065] Process the second linear transformation result using a second activation function to obtain a second activation processing result.

[0066] Perform layer normalization processing on the second activation processing result to obtain a second mapping feature.

[0067] Specifically, the second mapping feature FC2 can be expressed as: FC2 = LN(ReLU(W4 × FC1 + b4)), where W4 is a learnable fourth weight and b4 is a fourth bias term.

[0068] S32. Perform a third mapping process on the second mapping feature to obtain a third mapping feature.

[0069] In the embodiment of the present invention, the third mapping process may include: Perform a linear transformation process on the second mapping feature to obtain a third linear transformation result.

[0070] Perform layer normalization processing on the third linear transformation result to obtain a third mapping feature.

[0071] Specifically, the third mapping feature FC3 can be expressed as: FC3 = LN(W5 × FC2 + b5), where W5 is a learnable fifth weight and b5 is a fifth bias term.

[0072] S33. Perform an L2 normalization operation on the third mapping feature to obtain the output feature of the feature mapping module.

[0073] In the embodiment of the present invention, the output feature FC of the feature mapping module can be expressed as: FC = (FC3) / |FC3|². |FC3|² is the L2 regularization term of FC3.

[0074] Furthermore, in the first-stage training, update the parameters of the data processing model based on the contrast loss value. In the embodiment of the present invention, in order to make the data features that are positive samples of each other close to each other in the feature space and the data features that are negative samples of each other far from each other in the feature space, the loss function of contrast learning is defined as the maximum consistency between all data features that are positive samples of each other.

[0075] In the embodiment of the present invention, the original text data and one piece of augmented data are positive samples of each other, and two pieces of augmented data corresponding to the same original text data are positive samples of each other.

[0076] In an embodiment of the present invention, a loss function based on mutual information can be used to calculate the contrast loss value, so as to enhance the model's understanding of the same sample variant through positive sample contrast, reduce the sensitivity of the text classification model to the trigger, and further reduce the connection between the trigger in the sample and the target label set by the attacker.

[0077] Specifically, in an embodiment of the present invention, the contrast loss value of the training data for each batch satisfies the following conditions: .

[0078] Where, L contra is the contrast loss value of the training data for each batch. I uv is the contrast loss value of the features corresponding to the u-th training data and the v-th training data that are positive samples of each other in the training data for each batch. The values of u and v are both from 1 to N, and N is the number of training data for each batch. , where, sim(z u , z u ) represents the similarity between the features corresponding to the u-th training data and the v-th training data. sim(z u , z d ) represents the similarity between the features corresponding to the u-th training data and the features corresponding to the d-th training data. The value of d is from 1 to N; τ is the temperature coefficient, X is the indicator function. If d≠u, X = 1, otherwise, that is, if d = u, X = 0. exp() is the exponential function.

[0079] In an embodiment of the present invention, the similarity can be the cosine similarity.

[0080] In an embodiment of the present invention, the training data for each batch can be set according to actual needs. In a schematic embodiment, it can include an original text data and the corresponding enhanced data. When performing the first-stage training on the natural language processing model, the natural language processing model is an initialized model, that is, the parameters are initialized parameters. Those skilled in the art know that any training method of using the first training set to perform the first-stage training on the natural language processing model belongs to the protection scope of the present invention.

[0081] Furthermore, in an embodiment of the present invention, the prediction module can be an existing text classifier, which can be composed of two fully connected layers. By controlling the input and output dimensions of the two fully connected layers, the high-dimensional features of the sample are mapped to the number of text categories.

[0082] In an embodiment of the present invention, the second data set is clean text data, that is, data without data augmentation. During the process of training the intermediate model using the second data set, the parameters of the data processing model are updated based on the contrast loss value, and the parameters of the prediction module are updated based on the classification loss value. The classification loss value can be the cross-entropy loss.

[0083] Those skilled in the art know that any method of training the intermediate model using the second data set falls within the protection scope of the present invention.

[0084] In an embodiment of the present invention, the provided method may further include: testing the final natural language processing model using a test data set with a trigger.

[0085] In an embodiment of the present invention, the test data set with a trigger can be obtained by implanting a certain trigger into an existing test data set.

[0086] Those skilled in the art know that any method of testing the final natural language processing model using a test data set with a trigger falls within the protection scope of the present invention.

[0087] In summary, for the processing method for backdoor attack defense of a natural language processing model provided by the embodiments of the present invention, since the features for classification prediction integrate multiple features such as weighted features, classification marker features, and multi-scale convolution features, and at the same time use contrast learning to fine-tune the model, the final natural language processing model can have a better backdoor attack defense effect. Specifically, the feature weighting module can make the model pay more attention to the key parts of the text, ignore the small perturbations caused by the trigger to the text, reduce the interference of the trigger on the model's decision-making, and the convolution feature extraction module can enable the model to simultaneously pay attention to words, phrases, and sentences in the text, expand the receptive field of the model, and make the model have a better resistance to the perturbations caused by triggers of different granularities to the original text. Contrast learning narrows the distance between positive samples and widens the distance between negative samples, enhancing the robustness of the model, that is, the ability of the model to resist the interference of the trigger on the model's decision-making, and at the same time enhancing the generalization ability of the model, and having a defense effect on multiple data sets.

[0088] Based on the same inventive concept, an embodiment of the present invention provides a processing device for backdoor attack defense of a natural language processing model, and the device includes: A data acquisition module, configured to acquire the original text data set and divide the acquired original text data set into a first data set and a second data set.

[0089] A data augmentation module, configured to perform data augmentation processing on the first data set to obtain an augmented data set of the first data set, and merge the first data set and the corresponding augmented data set as the first training data set.

[0090] The first training module is configured to perform first-stage training on an initial natural language processing model using a first training data set, and use the natural language processing model after the first-stage training as an intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification marker feature acquisition module, a convolutional feature extraction module, a feature fusion module, a feature mapping module, and a normalization processing module. The initial feature acquisition module is respectively connected to the feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module. The feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module are also respectively connected to the feature fusion module. The feature fusion module, the feature mapping module, and the normalization processing module are connected in sequence.

[0091] The second training module is configured to perform second-stage training on the intermediate model using a second data set, and use the intermediate model after the second-stage training as the final natural language processing model. This device can be used to execute Figure 1 the method shown in the embodiments shown, and therefore, for the functions that can be realized by each functional module of this device, reference can be made to Figure 1 the description of the embodiments shown, which will not be elaborated here.

[0092] An embodiment of the present invention further provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method of the embodiment of the present invention.

[0093] An embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, and the computer instructions are used to execute the method of the embodiment of the present invention.

[0094] It should be understood that various forms of the processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in the present invention can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present invention can be achieved. No limitation is imposed herein.

[0095] The above specific embodiments do not constitute a limitation to the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A processing method for backdoor attack defense of natural language processing models, characterized in that, The method includes the following steps: S100, dividing the obtained original text dataset into a first dataset and a second dataset; S200, performing data augmentation processing on the first dataset to obtain an augmented dataset of the first dataset, and merging the first dataset and the corresponding augmented dataset as the first training dataset; S300, using the first training dataset to perform the first-stage training on the initial natural language processing model, and using the natural language processing model after the first-stage training as an intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification marker feature acquisition module, a convolutional feature extraction module, a feature fusion module, and a feature mapping module. The initial feature acquisition module is respectively connected to the feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module. The feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module are also respectively connected to the feature fusion module. The feature fusion module, the feature mapping module, and the prediction module are connected in sequence; S400, using the second dataset to perform the second-stage training on the intermediate model, and using the intermediate model after the second-stage training as the final natural language processing model.

2. The method according to claim 1, wherein The initial feature acquisition module includes a pre-trained encoder and an initial feature fusion module. The initial feature fusion module is used to fuse a plurality of initial features obtained by the pre-trained encoder to obtain fused initial features and send them to the feature weighting module and the convolutional feature extraction module respectively; the classification marker feature acquisition module is used to acquire the classification marker features in the initial features output by the last layer of the pre-trained encoder.

3. The method according to claim 2, wherein The feature weighting module is used to perform weighting processing on the received fused initial features to obtain corresponding weighted features.

4. The method according to claim 3, wherein The feature weighting module specifically performs the following steps: S10, performing a first linear transformation process on the received fused initial features to obtain a first feature; S11, using a first activation function to perform activation processing on the first feature and performing a second linear transformation process on the result after the activation processing to obtain a second feature; S13, performing an attention masking operation on the second feature to obtain a corresponding masking operation result as a third feature; S14, performing weighted summation on the third feature and the fused initial features to obtain the weighted feature.

5. The method according to claim 4, wherein The weighted feature satisfies the following conditions: Fa = ∑ n j=1 (FL j ⊙H j ) Among them, Fa is the weighted feature, FL j is the eigenvalue of the j-th feature in the eigenvector obtained by normalizing the third feature, where j ranges from 1 to n, and n is the feature dimension of the eigenvector obtained by normalizing the third feature, H j is the eigenvalue of the j-th feature in the initial fused feature, and ⊙ represents dot product.

6. The method according to claim 2, wherein The convolutional feature extraction module includes m convolutional units, and the convolutional kernel sizes of any two convolutional units are different; wherein, the output feature of the convolutional feature extraction module is obtained through the following steps: S20, using the r-th convolutional unit to perform a convolutional operation on the received fused initial features to obtain the convolutional result of the r-th convolutional unit as the r-th convolutional result; the value of r ranges from 1 to m, and the initial value is 1; S21, sequentially performing activation and pooling processing on the r-th convolutional result to obtain a corresponding processing result as the r-th convolutional processing feature; S22, splicing the m convolutional processing features as the output feature of the convolutional feature extraction module.

7. The method according to claim 1, wherein The output features of the feature mapping module are obtained through the following steps: S30. Perform a first mapping process on the received input features to obtain first mapped features; S31. Perform a second mapping process on the first mapped features to obtain second mapped features; S32. Perform a third mapping process on the second mapped features to obtain third mapped features; S33. Perform an L2 normalization operation on the third mapped features to obtain the output features of the feature mapping module.

8. The method according to claim 1, characterized in that In the first-stage training, update the parameters of the data processing model based on the contrast loss value; Among them, the contrast loss value of the training data for each batch satisfies the following conditions: ； Among them, L contra is the contrast loss value of the training data for each batch. I uv is the contrast loss value of the features corresponding to the \(u\)-th and \(v\)-th training data that are positive samples of each other in the training data for each batch. The values of \(u\) and \(v\) both range from 1 to \(N\), where \(N\) is the number of training data for each batch. , where \(sim(z u , z u ) represents the similarity between the features corresponding to the \(u\)-th and \(v\)-th training data, and \(sim(z u , z d ) represents the similarity between the features corresponding to the \(u\)-th training data and the \(d\)-th training data. The value of \(d\) ranges from 1 to \(N\); \(\tau\) is the temperature coefficient, \(X\) is the indicator function. If \(d eq u\), \(X = 1\), otherwise, \(X = 0\), and \(exp()\) is the exponential function.

9. A processing device for defending against backdoor attacks in natural language processing models, characterized in that, The device includes: A data acquisition module, configured to acquire the original text dataset and divide the acquired original text dataset into a first dataset and a second dataset; A data augmentation module, which performs data augmentation processing on the first dataset to obtain an augmented dataset of the first dataset, and combines the first dataset and the corresponding augmented dataset as the first training dataset; A first training module, configured to use the first training dataset to perform first-stage training on the initial natural language processing model, and use the natural language processing model after the first-stage training as an intermediate model; The natural language processing model includes a data processing model and a prediction module. Among them, the data processing model includes an initial feature acquisition module, a feature weighting module, a classification marker feature acquisition module, a convolutional feature extraction module, a feature fusion module, a feature mapping module, and a normalization processing module. Among them, the initial feature acquisition module is respectively connected to the feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module. The feature weighting module, the classification marker feature acquisition module, and the convolutional feature extraction module are also respectively connected to the feature fusion module. The feature fusion module, the feature mapping module, and the normalization processing module are connected in sequence; A second training module, configured to use the second dataset to perform second-stage training on the intermediate model, and use the intermediate model after the second-stage training as the final natural language processing model.

Images