Processing method and device for backdoor attack defense of natural language processing model

Abstract

The present invention relates to the field of computer technology applications, and in particular to a method and apparatus for defending natural language processing models against backdoor attacks. The method comprises: using data augmentation to generate different views of a text sample for a first-stage training of the natural language processing model, and using clean text data for a second-stage training of the model. The present invention enables the model to learn important features of the text sample, ignoring the interference of small perturbations on the sample content, and destroying the strong connection between the trigger constructed by the attacker and the target category. This reduces the interference of the trigger on the model's decision-making and enhances the model's robustness, ensuring effective defense against backdoor attacks while maintaining the performance of the model's classification tasks.

Description

Technical Field

[0001] The present invention relates to the field of computer technology applications, and in particular to a processing method and device for defending against backdoor attacks on natural language processing models. Background Art

[0002] With the widespread use of artificial intelligence, deep neural networks are being used for text data processing tasks. However, deep neural networks are vulnerable to various attacks, such as data poisoning during the data collection phase, backdoor attacks during model training, and adversarial example attacks during the model decision-making phase. Compared to data poisoning and adversarial example attacks, backdoor attacks are more concealed because their triggers are difficult to detect and the backdoored model maintains normal performance for normal samples. Furthermore, backdoor attacks can achieve a high success rate at a low cost. Existing mainstream defenses against text backdoor attacks can be categorized by their respective objectives: training dataset-focused defenses, model-focused defenses, and model input-focused defenses. Dataset-focused defenses primarily use text feature differential analysis to detect and filter potentially poisoned samples in the training dataset, keeping the training dataset as clean as possible. However, this defense approach relies on large-scale training data, resulting in high computational overhead and a high risk of accidental sample deletion, which can reduce model training effectiveness. To reduce the additional overhead associated with cleaning backdoored data, a defense method targeting the model itself was proposed. This method primarily targets suspected poisoned models and employs methods such as model pruning and trigger reconstruction to adjust the model itself in order to eliminate backdoors. However, because model pruning and trigger reconstruction adjust the trained model, they can cause the model's performance in the original classification task to deteriorate. To maintain the model's performance as much as possible without modifying the trained model, a defense method targeting model input was proposed. This method leverages the model's sensitivity to triggers to perform trigger detection and filtering on text samples, ensuring that input samples contain as few triggers as possible that could interfere with model decisions. However, this defense method still suffers from the problem of mistakenly deleting clean samples, affecting the decision boundary, and the designed perturbations and thresholds can only target a specific trigger, resulting in poor generalization. Summary of the Invention

[0003] In view of the above technical problems, the technical solution adopted by the present invention is:

[0004] According to a first aspect of the present invention, a method for defending against backdoor attacks on a natural language processing model is provided, the method comprising the following steps:

[0005] S100: Divide the acquired original text data set into a first data set and a second data set.

[0006] S200 , performing data enhancement processing on a first data set to obtain an enhanced data set of the first data set, and merging the first data set and the corresponding enhanced data set as a first training data set.

[0007] S300, using the first training data set to perform the first stage training on the initial natural language processing model, and using the natural language processing model after the first stage training as the intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification label feature acquisition module, a convolution feature extraction module, a feature fusion module and a feature mapping module, wherein the initial feature acquisition module is respectively connected to the feature weighting module, the classification label feature acquisition module and the convolution feature extraction module, and the feature weighting module, the classification label feature acquisition module and the convolution feature extraction module are also respectively connected to the feature fusion module, and the feature fusion module, the feature mapping module and the prediction module are connected in sequence.

[0008] S400, performing a second-stage training on the intermediate model using the second data set, and using the intermediate model after the second-stage training as the final natural language processing model.

[0009] According to a second aspect of the present invention, there is provided a processing device for defending against backdoor attacks on a natural language processing model, the device comprising:

[0010] The data acquisition module is used to acquire an original text data set and divide the acquired original text data set into a first data set and a second data set.

[0011] The data enhancement module performs data enhancement processing on the first data set to obtain an enhanced data set of the first data set, and merges the first data set and the corresponding enhanced data set as a first training data set.

[0012] The first training module is used to perform the first stage training on the initial natural language processing model using the first training data set, and use the natural language processing model after the first stage training as the intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification mark feature acquisition module, a convolution feature extraction module, a feature fusion module, a feature mapping module and a normalization processing module, wherein the initial feature acquisition module is respectively connected to the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module, and the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module are also respectively connected to the feature fusion module, and the feature fusion module, the feature mapping module and the normalization processing module are connected in sequence.

[0013] The second training module is used to perform a second-stage training on the intermediate model using the second data set, and use the intermediate model after the second-stage training as the final natural language processing model.

[0014] The present invention has at least the following beneficial effects:

[0015] The processing method for defending against backdoor attacks on natural language processing models provided by an embodiment of the present invention includes using data enhancement to generate different views of text samples to perform first-stage training on the natural language processing model, and using clean text data to perform second-stage training on the model. This method enables the natural language processing model to learn important features of text samples, ignore the interference of small perturbations on sample content, destroy the strong connection between the trigger constructed by the attacker and the target category, reduce the interference of the trigger on the model decision, and effectively defend against backdoor attacks by enhancing the robustness of the model while maintaining the performance of the model classification task.

[0016] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a method for defending against backdoor attacks on natural language processing models provided by an embodiment of the present invention;

[0019] Figure 2 A framework diagram of the natural language processing model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0022] It should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of the steps can be performed in parallel, concurrently, or simultaneously. In addition, the order of the steps can be rearranged. A process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. A process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0023] In some application scenarios, users download pre-trained models from open-source websites, hoping to use them for a classification task, such as text classification. However, the pre-trained model cannot directly perform the classification task, and the user is unsure whether the pre-trained model contains backdoor attacks. The user's goal is to fine-tune the model while removing the backdoor so that the classification task can be performed normally.

[0024] In response to the above application scenarios, an embodiment of the present invention provides a processing method for defending against backdoor attacks on natural language processing models, aiming to fine-tune and train text classification models that may be subject to backdoor attacks by using self-supervised contrastive learning, and generate different views of text samples using data enhancement methods, so that the model can learn important features of the text samples, ignore the interference of small perturbations on the sample content, destroy the strong connection between the trigger that the attacker attempts to construct and the target category, reduce the interference of the trigger on the model decision, and achieve the model's defense effect against the backdoor trigger of the text sample.

[0025] like Figure 1 As shown, the processing method for defending against backdoor attacks on natural language processing models provided by an embodiment of the present invention may include the following steps:

[0026] S100: Divide the acquired original text data set into a first data set and a second data set.

[0027] In an embodiment of the present invention, the original text dataset may be an open source dataset, such as a news topic classification dataset and a sentiment classification dataset.

[0028] S200 , performing data enhancement processing on a first data set to obtain an enhanced data set of the first data set, and merging the first data set and the corresponding enhanced data set as a first training data set.

[0029] In an embodiment of the present invention, the enhanced data set is a data set obtained based on at least one data enhancement method, wherein one data enhancement method corresponds to one data pollution method.

[0030] Triggers play a crucial role in backdoor attacks on deep neural network models. When a trigger is present in the input sample of a poisoned model, the output classification label becomes the attacker's preset label. The direct reason for the success of backdoor attacks is that the attacker causes the backdoor model to learn a strong correlation between the trigger's features and the target label, causing it to misclassify text containing the trigger. The fundamental reason for the success of backdoor attacks is that the trigger's features dominate the features learned by the backdoor model, exerting a greater influence on the model's classification.

[0031] In an embodiment of the present invention, the data augmentation operation should consider various possible triggers used in backdoor attacks in the text field, and make the augmented text as similar as possible to the real trigger while ensuring that the basic features of the original text are not significantly changed. The data contamination method can be obtained based on the statistics of the backdoor trigger types that have been disclosed in the literature. In an exemplary embodiment, the data augmentation method may include: (1) replacing certain words in the original text data with synonyms; (2) inserting words at random positions in sentences in the original text data; (3) inserting sentences at random positions in sentences in the original text data; (4) back-translating the original text data using an English-Chinese-English method, etc.

[0032] S300: Perform a first-stage training on an initial natural language processing model using a first training data set, and use the natural language processing model after the first-stage training as an intermediate model.

[0033] In the embodiment of the present invention, Figure 2 As shown, the natural language processing model may include a data processing model and a prediction module 7. The data processing model includes an initial feature acquisition module 1, a feature weighting module 2, a classification mark feature acquisition module 3, a convolution feature extraction module 4, a feature fusion module 5 and a feature mapping module 6, wherein the initial feature acquisition module 1 is connected to the feature weighting module 2, the classification mark feature acquisition module 3 and the convolution feature extraction module 4 respectively, the feature weighting module 2, the classification mark feature acquisition module 3 and the convolution feature extraction module 4 are also connected to the feature fusion module 5 respectively, and the feature fusion module 5, the feature mapping module 6 and the prediction module 7 are connected in sequence.

[0034] S400, performing a second-stage training on the intermediate model using the second data set, and using the intermediate model after the second-stage training as the final natural language processing model.

[0035] The processing method for defending against backdoor attacks on natural language processing models provided by an embodiment of the present invention uses data enhancement to generate different views of text samples to perform first-stage training on the natural language processing model, and uses clean text data to perform second-stage training on the model. This enables the model to learn important features of text samples, ignore the interference of small perturbations on sample content, destroy the strong connection between the trigger constructed by the attacker and the target category, reduce the interference of the trigger on the model decision, and effectively defend against backdoor attacks by enhancing the robustness of the model while maintaining the performance of the model classification task.

[0036] Furthermore, in an embodiment of the present invention, the initial feature acquisition module 1 includes a pre-trained encoder 101 and an initial feature fusion module 102. The initial feature fusion module is used to fuse multiple initial features obtained by the pre-trained encoder to obtain fused initial features and send them to the feature weighting module and the convolution feature extraction module respectively.

[0037] In an embodiment of the present invention, the pre-trained encoder may be an encoder downloaded from an open source website, for example, a pre-trained BERT model, which may be a model with a backdoor implanted.

[0038] In this embodiment of the present invention, the fused initial features FM may satisfy the following conditions:

[0039] .

[0040] Among them, h i is the output feature of the i-th layer of the pre-trained encoder, LN (h i ) indicates the h i The features obtained after layer normalization, a i is the weight of the i-th layer of the pre-trained encoder, is a learnable weight, i ranges from 1 to L, and L is the number of layers of the pre-trained encoder.

[0041] In an embodiment of the present invention, the output features of each layer of the pre-trained encoder can be a tensor of dimension B × S × D, where B is the amount of text data to be encoded, which can be the number of training data batches during the training phase and the number of received text data during the testing phase. S is the sequence length of each text data, i.e., the word segmentation result of each text data, and D is the feature dimension, i.e., the feature dimension of each word, for example, 768 dimensions.

[0042] In the embodiment of the present invention, the classification mark feature acquisition module 3 is used to acquire the classification mark feature in the initial features output by the last layer of the pre-trained encoder.

[0043] In this embodiment of the present invention, the classification marker is a CLS token feature. When a natural language processing model processes an input sequence, a special marker is added at the beginning of the sequence to capture the global representation of the entire sequence. The CLS token feature in a pre-trained natural language processing model typically contains high-quality sequence representations, which can provide a global feature representation of the text for model training, reducing reliance on local features and, therefore, minimizing the impact of triggers on decision-making.

[0044] In the embodiment of the present invention, the feature weighting module 2 is used to perform weighted processing on the received fused initial features to obtain corresponding weighted features.

[0045] Furthermore, the feature weighting module is specifically configured to perform the following steps:

[0046] S10: Perform a first linear transformation on the received fused initial features to obtain a first feature.

[0047] Specifically, the first feature F1 satisfies the following condition: F1 = W1 × FM + b1, where W1 is the first learnable weight and b1 is the first bias term.

[0048] S11, using a first activation function to activate the first feature, and performing a second linear transformation on the result of the activation process to obtain a second feature.

[0049] In this embodiment of the present invention, the first activation function may be a tanh activation function. Specifically, the second feature F2 satisfies the following condition: F2 = W2 × tanh(F1) + b2. W2 is a second learnable weight, b2 is a second bias term, and tanh(F1) indicates activation of F1 using the tanh activation function.

[0050] S13, perform an attention mask operation on the second feature to obtain a corresponding mask operation result as the third feature.

[0051] In this embodiment of the present invention, the third feature F3 satisfies the following condition: F3 = F2 + (1-M) × (-∞). M is a mask matrix with the same feature dimension as F2, and the element values ​​in M ​​are 0 and 1. In M, the element value corresponding to the masked feature is 0, and otherwise it is 1. 1-M represents element-by-element subtraction of the all-ones matrix from M.

[0052] S14: Perform a weighted summation on the third feature and the received input feature to obtain the weighted feature.

[0053] In this embodiment of the present invention, the weighted features meet the following conditions:

[0054] Fa=∑ nj=1 (FL j ⊙H j ).

[0055] Among them, Fa is the weighted feature, FL j is the eigenvalue of the jth feature in the feature vector obtained after normalizing the third feature, j ranges from 1 to n, n is the feature dimension of the feature vector obtained after normalizing the third feature, H j is the eigenvalue of the jth feature in the fusion initial feature, ⊙ represents the dot product, that is, FL j ⊙H j Indicates that FL j The corresponding features and H j The corresponding features are multiplied element by element and then summed.

[0056] In the embodiment of the present invention, the third feature may be normalized by a softmax() function.

[0057] Furthermore, in an embodiment of the present invention, the convolutional feature extraction module includes m convolutional units, and the convolution kernel sizes of any two convolutional units are different. In one exemplary embodiment, m = 3, i.e., three convolutional units are included. The convolution kernel sizes of the three convolutional units can be 1, 3, and 5, respectively, corresponding to the feature extraction of words, phrases, and sentences.

[0058] The convolutional feature extraction module uses multiple convolutions of different sizes to capture sequence patterns of different lengths, allowing the model to focus on both local and global features of the text, improving its ability to capture complex language patterns, and enabling the model to understand the text content more comprehensively, thereby reducing the decision-making process's dependence on trigger features and improving the performance of downstream tasks.

[0059] Furthermore, the output features of the convolutional feature extraction module are obtained through the following steps:

[0060] S20, using the rth convolution unit to perform a convolution operation on the received fused initial features, and obtain the convolution result of the rth convolution unit as the rth convolution result; the value of r is 1 to m, and the initial value is 1.

[0061] Those skilled in the art know that the convolution operation of the convolution unit may be an existing convolution method.

[0062] S21, activate and pool the r-th convolution result in sequence to obtain the corresponding processing result as the r-th convolution processing feature.

[0063] In an embodiment of the present invention, a ReLU activation function may be used to activate the convolution result. The pooling process may be a maximum pooling process.

[0064] S22, concatenate the m convolution processing features as the output features of the convolution feature extraction module.

[0065] In this embodiment of the present invention, feature fusion module 5 is used to combine the weighted features, classification tag features, and output features of the convolutional feature extraction module, and use the resulting combination as the fused features. The fused features provide more perspectives, are more flexible, and contain more information, thereby reducing the model's reliance on a single trigger feature during the decision-making process and enabling adaptation to a wider range of tasks.

[0066] Furthermore, in this embodiment of the present invention, a feature mapping module is used to convert the received fused features into a more compact and discriminative representation. In contrastive learning tasks, this representation should be able to better capture the semantic similarity between samples while maintaining the ability to distinguish between different categories. In backdoor defense, this can reduce the time and computational resource consumption during training while maintaining defense performance.

[0067] In an embodiment of the present invention, a step-by-step compression method is used to perform feature mapping on the received fusion features, which can reduce the feature dimension while retaining as much useful information as possible. Layer normalization, ReLU activation function, and dropout layer are used in the compression process to help make training more stable during feature mapping, enhance the generalization ability of the model, and prevent overfitting. Finally, an L2 normalization operation is performed on the mapped features, and the extracted text features are output. The L2 normalization operation eliminates the scale differences between different samples and contributes to the numerical stability of the model. Specifically, the output features of the feature mapping module are obtained through the following steps:

[0068] S30: Perform a first mapping process on the received input feature to obtain a first mapping feature.

[0069] In an embodiment of the present invention, the first mapping process includes:

[0070] Perform a first linear transformation on the received input features to obtain a first linear transformation result.

[0071] The first linear transformation result is processed using the second activation function to obtain a first activation processing result.

[0072] In an embodiment of the present invention, the second activation function is a ReLU activation function.

[0073] A layer normalization process is performed on the first activation processing result to obtain a first mapping feature.

[0074] Specifically, the first mapping feature FC1 can be expressed as: FC1=LN(ReLU(W3×FMM+b3)), where W3 is the learnable third weight, b3 is the third bias term, FMM is the fusion feature, LN() represents layer normalization processing, and ReLU() is the ReLU activation function.

[0075] S31, performing a second mapping process on the first mapping feature to obtain a second mapping feature.

[0076] In this embodiment of the present invention, the second mapping process may include:

[0077] Performing linear transformation processing on the first mapping feature to obtain a second linear transformation result.

[0078] The second linear transformation result is processed using a second activation function to obtain a second activation processing result.

[0079] The second activation processing result is subjected to layer normalization processing to obtain a second mapping feature.

[0080] Specifically, the second mapping feature FC2 can be expressed as: FC2=LN(ReLU(W4×FC1+b4)), where W4 is the learnable fourth weight and b4 is the fourth bias term.

[0081] S32: Perform a third mapping process on the second mapping feature to obtain a third mapping feature.

[0082] In this embodiment of the present invention, the third mapping process may include:

[0083] Performing linear transformation processing on the second mapping feature to obtain a third linear transformation result.

[0084] The third linear transformation result is subjected to layer normalization processing to obtain the third mapping feature.

[0085] Specifically, the third mapping feature FC3 can be expressed as: FC3=LN(W5×FC2+b5), where W5 is the learnable fifth weight and b5 is the fifth bias term.

[0086] S33: Perform an L2 normalization operation on the third mapping feature to obtain an output feature of the feature mapping module.

[0087] In the embodiment of the present invention, the output feature FC of the feature mapping module can be expressed as: FC=(FC3) / |FC3|2, where |FC3|2 is the L2 regularization term of FC3.

[0088] Furthermore, in the first stage of training, the parameters of the data processing model are updated based on the contrastive loss value. In this embodiment of the present invention, in order to make the data features that are mutually positive samples close to each other in the feature space and the data features that are mutually negative samples far away from each other in the feature space, the loss function of contrastive learning is defined as the maximum consistency between all data features that are mutually positive samples.

[0089] In the embodiment of the present invention, the original text data and a piece of enhanced data are positive samples of each other, and the two pieces of enhanced data corresponding to the same original text data are positive samples of each other.

[0090] In an embodiment of the present invention, a loss function based on mutual information can be used to calculate the contrast loss value, so as to enhance the model's understanding of the same sample variants through positive sample comparison, reduce the sensitivity of the text classification model to triggers, and thereby reduce the connection between the trigger in the sample and the target label set by the attacker.

[0091] Specifically, in this embodiment of the present invention, the contrast loss value of each batch of training data meets the following conditions:

[0092] .

[0093] Among them, L contra is the contrast loss value for each batch of training data. uv The comparative loss value of the features corresponding to the u-th training data and the v-th training data in each batch of training data, which are positive samples of each other, is 1 to N, where N is the number of training data in each batch. , where sim(z u , z u ) represents the similarity between the features corresponding to the u-th training data and the v-th training data, sim(z u , z d ) represents the similarity between the feature corresponding to the u-th training data and the feature corresponding to the d-th training data, where d ranges from 1 to N; τ is the temperature coefficient, and X is the indicator function. If d ≠ u, X = 1; otherwise, if d = u, X = 0. exp() is the exponential function.

[0094] In the embodiment of the present invention, the similarity may be cosine similarity.

[0095] In an embodiment of the present invention, each batch of training data can be set based on actual needs. In an exemplary embodiment, it can include a piece of original text data and corresponding enhanced data. When the natural language processing model is trained in the first stage, the natural language processing model is an initialized model, that is, the parameters are initialized parameters. It is known to those skilled in the art that any training method that uses the first training set to train the natural language processing model in the first stage falls within the scope of protection of the present invention.

[0096] Furthermore, in an embodiment of the present invention, the prediction module may be an existing text classifier, which may be composed of two fully connected layers. By controlling the input and output dimensions of the two fully connected layers, the high-dimensional features of the sample are mapped to the number of text categories.

[0097] In this embodiment of the present invention, the second dataset is clean text data, i.e., data that has not undergone data augmentation. During training of the intermediate model using the second dataset, the parameters of the data processing model are updated based on the contrastive loss value, and the parameters of the prediction module are updated based on the classification loss value. The classification loss value may be a cross-entropy loss.

[0098] It is known to those skilled in the art that any method of using the second data set to train the intermediate model falls within the scope of protection of the present invention.

[0099] In an embodiment of the present invention, the provided method may further include: testing the final natural language processing model using a test data set with triggers.

[0100] In the embodiment of the present invention, the test data set with triggers can be obtained by implanting certain triggers into the existing test data set.

[0101] Those skilled in the art will appreciate that any method for testing the final natural language processing model using a test data set with triggers falls within the scope of protection of the present invention.

[0102] In summary, the processing method for backdoor attack defense of natural language processing models provided by the embodiment of the present invention, because the features used for classification prediction integrate multiple features such as weighted features, classification labeling features and multi-scale convolution features, and at the same time use contrastive learning to fine-tune the model, can make the final natural language processing model have better backdoor attack defense effect. Specifically, the feature weighting module can make the model pay more attention to the key parts in the text, ignore the small disturbances caused by triggers to the text, and reduce the interference of triggers on model decisions. The convolutional feature extraction module can make the model pay attention to words, phrases, and sentences in the text at the same time, expand the receptive field of the model, and make the model have better resistance to disturbances caused by triggers of different granularities on the original text. Contrastive learning shortens the distance between positive samples and pushes the distance between negative samples, enhancing the robustness of the model, that is, the ability of the model to resist the interference of triggers on model decisions, and at the same time enhances the generalization ability of the model, which can have a defensive effect on a variety of data sets.

[0103] Based on the same inventive concept, an embodiment of the present invention provides a processing device for defending against backdoor attacks on a natural language processing model, the device comprising:

[0104] The data acquisition module is used to acquire an original text data set and divide the acquired original text data set into a first data set and a second data set.

[0105] The data enhancement module performs data enhancement processing on the first data set to obtain an enhanced data set of the first data set, and merges the first data set and the corresponding enhanced data set as a first training data set.

[0106] The first training module is used to perform the first stage training on the initial natural language processing model using the first training data set, and use the natural language processing model after the first stage training as the intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification mark feature acquisition module, a convolution feature extraction module, a feature fusion module, a feature mapping module and a normalization processing module, wherein the initial feature acquisition module is respectively connected to the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module, and the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module are also respectively connected to the feature fusion module, and the feature fusion module, the feature mapping module and the normalization processing module are connected in sequence.

[0107] The second training module is used to perform the second stage training on the intermediate model using the second data set, and the intermediate model after the second stage training is used as the final natural language processing model. Figure 1The method shown in the embodiment shown, therefore, for the functions that can be realized by each functional module of the device, please refer to Figure 1 The description of the illustrated embodiment is omitted for brevity.

[0108] An embodiment of the present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in the embodiment of the present invention.

[0109] An embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer instructions are used to execute the method described in the embodiment of the present invention.

[0110] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present invention can be achieved. This is not limited herein.

[0111] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for defending against backdoor attacks on natural language processing models, characterized in that: The method comprises the following steps: S100, dividing the obtained original text data set into a first data set and a second data set; S200, performing data enhancement processing on the first data set to obtain an enhanced data set of the first data set, and merging the first data set and the corresponding enhanced data set as a first training data set; S300, performing a first phase of training on an initial natural language processing model using a first training data set, and using the natural language processing model after the first phase of training as an intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification label feature acquisition module, a convolutional feature extraction module, a feature fusion module, and a feature mapping module, wherein the initial feature acquisition module is respectively connected to the feature weighting module, the classification label feature acquisition module, and the convolutional feature extraction module, and the feature weighting module, the classification label feature acquisition module, and the convolutional feature extraction module are further respectively connected to the feature fusion module, and the feature fusion module, the feature mapping module, and the prediction module are sequentially connected; S400, performing a second-stage training on the intermediate model using the second data set, and using the intermediate model after the second-stage training as the final natural language processing model; In the first stage of training, the parameters of the data processing model are updated based on the contrast loss value; Among them, the contrast loss value of each batch of training data meets the following conditions: ； Among them, L contra is the contrast loss value of each batch of training data, I uv The comparative loss value of the features corresponding to the u-th training data and the v-th training data in each batch of training data, which are positive samples of each other, is 1 to N, where N is the number of training data in each batch. , where sim(z u , z u ) represents the similarity between the features corresponding to the u-th training data and the v-th training data, sim(z u , z d ) represents the similarity between the feature corresponding to the u-th training data and the feature corresponding to the d-th training data, and the value of d ranges from 1 to N; τ is the temperature coefficient, X is the indicator function, if d≠u, X=1, otherwise, X=0, exp() is the exponential function.

2. The method according to claim 1, characterized in that The initial feature acquisition module includes a pre-trained encoder and an initial feature fusion module. The initial feature fusion module is used to fuse multiple initial features obtained by the pre-trained encoder to obtain fused initial features and send them to the feature weighting module and the convolution feature extraction module respectively; the classification mark feature acquisition module is used to obtain the classification mark features in the initial features output by the last layer of the pre-trained encoder.

3. The method according to claim 2, characterized in that The feature weighting module is used to perform weighted processing on the received fused initial features to obtain corresponding weighted features.

4. The method according to claim 3, characterized in that The feature weighting module is specifically configured to perform the following steps: S10, performing a first linear transformation on the received fused initial features to obtain a first feature; S11, using a first activation function to activate the first feature, and performing a second linear transformation on the result of the activation process to obtain a second feature; S13, performing an attention mask operation on the second feature to obtain a corresponding mask operation result as the third feature; S14: Perform weighted summation on the third feature and the fused initial feature to obtain the weighted feature.

5. The method according to claim 4, characterized in that The weighted features meet the following conditions: Fa=∑ n j=1 (FL) j ⊙H j ); Among them, Fa is the weighted feature, FL j is the eigenvalue of the jth feature in the feature vector obtained after normalizing the third feature, j ranges from 1 to n, n is the feature dimension of the feature vector obtained after normalizing the third feature, H j is the eigenvalue of the jth feature in the fusion initial features, and ⊙ represents the dot product.

6. The method according to claim 2, characterized in that The convolution feature extraction module includes m convolution units, and the convolution kernel sizes of any two convolution units are different. The output features of the convolution feature extraction module are obtained through the following steps: S20, using the rth convolution unit to perform a convolution operation on the received fused initial features, and obtain the convolution result of the rth convolution unit as the rth convolution result; the value of r ranges from 1 to m, and the initial value is 1; S21, activate and pool the r-th convolution result in sequence to obtain the corresponding processing result as the r-th convolution processing feature; S22, concatenate the m convolution processing features as the output features of the convolution feature extraction module.

7. The method according to claim 1, characterized in that The output features of the feature mapping module are obtained through the following steps: S30, performing a first mapping process on the received input feature to obtain a first mapping feature; S31, performing a second mapping process on the first mapping feature to obtain a second mapping feature; S32, performing a third mapping process on the second mapping feature to obtain a third mapping feature; S33: Perform an L2 normalization operation on the third mapping feature to obtain an output feature of the feature mapping module.

8. A processing device for defending against backdoor attacks on natural language processing models, characterized in that: The device comprises: A data acquisition module, configured to acquire an original text data set and divide the acquired original text data set into a first data set and a second data set; a data enhancement module, performing data enhancement processing on the first data set to obtain an enhanced data set of the first data set, and merging the first data set and the corresponding enhanced data set as a first training data set; a first training module, used to perform a first-stage training on the initial natural language processing model using the first training data set, and using the natural language processing model after the first-stage training as an intermediate model; the natural language processing model includes a data processing model and a prediction module, wherein the data processing model includes an initial feature acquisition module, a feature weighting module, a classification mark feature acquisition module, a convolution feature extraction module, a feature fusion module, a feature mapping module and a normalization processing module, wherein the initial feature acquisition module is respectively connected to the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module, and the feature weighting module, the classification mark feature acquisition module and the convolution feature extraction module are also respectively connected to the feature fusion module, and the feature fusion module, the feature mapping module and the normalization processing module are connected in sequence; A second training module is used to perform a second-stage training on the intermediate model using the second data set, and use the intermediate model after the second-stage training as the final natural language processing model; In the first stage of training, the parameters of the data processing model are updated based on the contrast loss value; Among them, the contrast loss value of each batch of training data meets the following conditions: ； Among them, L contra is the contrast loss value of each batch of training data, I uv The comparative loss value of the features corresponding to the u-th training data and the v-th training data in each batch of training data, which are positive samples of each other, is 1 to N, where N is the number of training data in each batch. , where sim(z u , z u ) represents the similarity between the features corresponding to the u-th training data and the v-th training data, sim(z u , z d ) represents the similarity between the feature corresponding to the u-th training data and the feature corresponding to the d-th training data, and the value of d ranges from 1 to N; τ is the temperature coefficient, X is the indicator function, if d≠u, X=1, otherwise, X=0, exp() is the exponential function.

Images