Bayesian network-based method for realizing backdoor attack detection of general pre-training model

Abstract

The invention relates to a method for realizing backdoor attack detection control of a general pre-training model based on a Bayesian network, and mainly relates to the field of artificial intelligence security. According to the method, a probability model is established for activation features, dimension reduction data and output results of each layer in a pre-training model (such as ResNet-50), and a Bayesian network is utilized to perform reasoning on an input sample, so that real-time detection of the backdoor attack is realized. The core of the method is that a Bayesian network is constructed by using a conditional dependency relationship among input, a plurality of intermediate feature nodes and output nodes, and an abnormal sample is judged by comparing a backdoor attack probability with a preset threshold in combination with an online parameter updating strategy. The method has the advantages of high detection accuracy, high applicability, excellent dynamic updating capability and the like, has an important application value in the field of artificial intelligence security detection, can effectively prevent backdoor attack risks, guarantees the security and stability of various pre-training models in practical application, and is suitable for popularization and application. The method can be widely applied to safety protection of images, videos and other pre-training models.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security, and in particular to a method for detecting and controlling backdoor attacks on general pre-trained models based on a Bayesian network. The method is suitable for real-time detection and defense of backdoor attacks on images, videos, and other pre-trained models. Background Art

[0002] With the rapid development of deep learning technology, pre-trained models have become a core technology in fields such as computer vision and natural language processing. However, pre-trained models face serious security threats, particularly backdoor attacks. Backdoor attacks embed specific trigger patterns in training data, causing the model to perform well under normal inputs but produce erroneous outputs designed by the attacker when encountering inputs containing specific triggers.

[0003] Currently, backdoor attack detection methods are mainly divided into three categories: training data-based detection, model parameter-based detection, and input-output-based detection. Training data-based methods require access to the original training data, which is often impractical in practical applications; model parameter-based methods are generally computationally complex and difficult to apply in real time; and input-output-based methods, while computationally efficient, have limited detection accuracy. Bayesian networks, as probabilistic graphical models, can effectively model conditional dependencies between variables and have been successfully applied in various fields. However, there is no prior research on applying Bayesian networks to backdoor attack detection in pre-trained models. Traditional Bayesian network methods face the curse of dimensionality when processing high-dimensional deep learning features and lack specialized designs for the hierarchical features of pre-trained models. Therefore, a backdoor attack detection method that can effectively utilize the multi-level features of pre-trained models, achieves high detection accuracy, and performs in real time is urgently needed to ensure the security of pre-trained models in practical applications. Summary of the Invention

[0004] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a method for detecting and controlling backdoor attacks based on a universal pre-trained model based on a Bayesian network, which has the characteristics of high detection accuracy, strong applicability, and excellent dynamic update capability.

[0005] In order to achieve the above objectives, the method of the present invention for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network is as follows:

[0006] The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network is characterized in that the method comprises the following steps:

[0007] (1) Perform hierarchical feature extraction on the target pre-trained model to obtain activation features of the input layer, multiple intermediate layers, and output layer;

[0008] (2) Perform dimensionality reduction processing on the extracted features of each layer to obtain low-dimensional feature vectors;

[0009] (3) Constructing a Bayesian network based on the reduced-dimensional feature vector, including input nodes, multiple intermediate feature nodes, and output nodes, and establishing the conditional probability distribution between each node;

[0010] (4) Use the normal sample set to train the Bayesian network parameters and learn the normal dependency relationship between the features of each layer;

[0011] (5) Perform real-time reasoning on the samples to be tested and calculate the backdoor attack probability of the samples to be tested in the Bayesian network;

[0012] (6) Compare the calculated backdoor attack probability with a preset threshold to determine whether the sample to be detected is a backdoor attack sample;

[0013] (7) Dynamically update the Bayesian network parameters based on the detection results.

[0014] Preferably, the hierarchical feature extraction in step (1) specifically includes:

[0015] (1.1) Select the key layers of the pre-trained model as feature extraction points, including the input layer, shallow feature extraction layer, middle semantic extraction layer and output classification layer;

[0016] (1.2) Perform forward propagation on the input sample and record the activation features of each selected layer;

[0017] (1.3) The obtained activation features are normalized.

[0018] Preferably, the dimensionality reduction process in step (2) adopts a principal component analysis method, specifically:

[0019] (2.1) The activation feature matrix of each feature extraction layer is reduced in dimension using the principal component analysis method;

[0020] (2.2) retain the original information variance;

[0021] (2.3) Normalize the feature vector after dimensionality reduction.

[0022] Preferably, the construction of the Bayesian network model in step (3) includes:

[0023] (3.1) Create a feature node for each feature extraction layer;

[0024] (3.2) Establish directed edges between nodes based on the forward propagation path of the pre-trained model;

[0025] (3.3) Define a conditional probability table for each node;

[0026] (3.4) Add backdoor attack state variables to the output node.

[0027] Preferably, the maximum likelihood estimation method is used to train the Bayesian network parameters using the normal sample set in step (4), specifically:

[0028] (4.1) Use a large number of normal samples for forward propagation to collect feature data at each layer;

[0029] (4.2) Statistical conditional probability distribution between nodes;

[0030] (4.3) Laplace smoothing is used for rare events.

[0031] Preferably, the real-time reasoning in step (5) adopts a Bayesian network reasoning algorithm, specifically:

[0032] (5.1) Input the features of each layer of the sample to be tested into the Bayesian network;

[0033] (5.2) Calculate the posterior probability of the backdoor attack state given the observed features;

[0034] (5.3) Output the backdoor attack probability score.

[0035] Preferably, the threshold comparison in step (6) adopts a dynamic adjustment strategy, specifically:

[0036] (6.1) Set the initial threshold according to the model application scenario;

[0037] (6.2) Dynamically adjust the threshold according to the statistical distribution of the test results;

[0038] (6.3) Differentiated threshold strategies are adopted for different types of samples.

[0039] Preferably, the updating of the Bayesian network parameters in step (7) adopts an online learning strategy, specifically:

[0040] (7.1) Automatically add samples judged to be normal to the training set;

[0041] (7.2) Periodically re-estimate the Bayesian network parameters;

[0042] (7.3) Keep the statistical information of historical data for incremental learning.

[0043] This Bayesian network-based method for detecting and controlling backdoor attacks on a universal pre-trained model uses a Bayesian network. By establishing probabilistic dependencies between the pre-trained model's multi-level features, it effectively captures abnormal patterns caused by backdoor attacks. Dimensionality reduction solves the computational complexity associated with high-dimensional features. Finally, a dynamic update mechanism enables the system to adapt to changes in data distribution. This method boasts clear and simple logic, high execution efficiency, and effective utilization of the pre-trained model's multi-level features. It offers high detection accuracy and real-time performance, offering significant technical advantages and application value in the construction of pre-trained model attack sample datasets and in the field of algorithmic model security. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of the method for realizing backdoor attack detection and control of a universal pre-trained model based on a Bayesian network of the present invention.

[0045] Figure 2 This is a schematic diagram of PCA dimensionality reduction of the method for realizing backdoor attack detection and control of a universal pre-trained model based on a Bayesian network of the present invention.

[0046] Figure 3 A schematic diagram of establishing directed edges between nodes in the method for realizing universal pre-training model backdoor attack detection and control based on Bayesian network of the present invention. DETAILED DESCRIPTION

[0047] In order to more clearly describe the technical content of the present invention, further description is given below in conjunction with specific embodiments.

[0048] The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network of the present invention comprises the following steps:

[0049] (1) Perform hierarchical feature extraction on the target pre-trained model to obtain activation features of the input layer, multiple intermediate layers, and output layer;

[0050] (2) Perform dimensionality reduction processing on the extracted features of each layer to obtain low-dimensional feature vectors;

[0051] (3) Constructing a Bayesian network based on the feature vector after dimensionality reduction, including input nodes, multiple intermediate feature nodes and output nodes, and establishing the conditional probability distribution between each node;

[0052] (4) Use the normal sample set to train the Bayesian network parameters and learn the normal dependency relationship between the features of each layer;

[0053] (5) Perform real-time reasoning on the samples to be tested and calculate the backdoor attack probability of the samples to be tested in the Bayesian network;

[0054] (6) Compare the calculated backdoor attack probability with a preset threshold to determine whether the sample to be detected is a backdoor attack sample;

[0055] (7) Dynamically update the Bayesian network parameters based on the detection results.

[0056] As a preferred embodiment of the present invention, the hierarchical feature extraction in step (1) specifically includes:

[0057] (1.1) Select the key layers of the pre-trained model as feature extraction points, including the input layer, shallow feature extraction layer, middle semantic extraction layer and output classification layer;

[0058] (1.2) Perform forward propagation on the input sample and record the activation features of each selected layer;

[0059] (1.3) The obtained activation features are normalized.

[0060] As a preferred embodiment of the present invention, the dimensionality reduction process in step (2) adopts the principal component analysis method, specifically:

[0061] (2.1) The activation feature matrix of each feature extraction layer is reduced in dimension using the principal component analysis method;

[0062] (2.2) retain the original information variance;

[0063] (2.3) Normalize the feature vector after dimensionality reduction.

[0064] As a preferred embodiment of the present invention, the construction of the Bayesian network model in step (3) includes:

[0065] (3.1) Create a feature node for each feature extraction layer;

[0066] (3.2) Establish directed edges between nodes based on the forward propagation path of the pre-trained model;

[0067] (3.3) Define a conditional probability table for each node;

[0068] (3.4) Add backdoor attack state variables to the output node.

[0069] As a preferred embodiment of the present invention, the maximum likelihood estimation method is used to train the Bayesian network parameters using the normal sample set in step (4), specifically:

[0070] (4.1) Use a large number of normal samples for forward propagation to collect feature data at each layer;

[0071] (4.2) Statistical conditional probability distribution between nodes;

[0072] (4.3) Laplace smoothing is used for rare events.

[0073] As a preferred embodiment of the present invention, the real-time reasoning in step (5) adopts a Bayesian network reasoning algorithm, specifically:

[0074] (5.1) Input the features of each layer of the sample to be tested into the Bayesian network;

[0075] (5.2) Calculate the posterior probability of the backdoor attack state given the observed features;

[0076] (5.3) Output the backdoor attack probability score.

[0077] As a preferred embodiment of the present invention, the threshold comparison in step (6) adopts a dynamic adjustment strategy, specifically:

[0078] (6.1) Set the initial threshold according to the model application scenario;

[0079] (6.2) Dynamically adjust the threshold according to the statistical distribution of the test results;

[0080] (6.3) Differentiated threshold strategies are adopted for different types of samples.

[0081] As a preferred embodiment of the present invention, the updating of the Bayesian network parameters in step (7) adopts an online learning strategy, specifically:

[0082] (7.1) Automatically add samples judged to be normal to the training set;

[0083] (7.2) Periodically re-estimate the Bayesian network parameters;

[0084] (7.3) Keep the statistical information of historical data for incremental learning.

[0085] Specific embodiments of the present invention utilize probabilistic modeling of multi-level features, efficient dimensionality reduction, and a dynamic update mechanism to achieve high-accuracy, low-false-alarm backdoor attack detection. This approach, combined with broad applicability and excellent real-time performance, offers significant application value in the field of artificial intelligence security. This invention utilizes a Bayesian network to detect backdoor attacks against general pre-trained models, a technique currently unavailable in the field.

[0086] The general pre-training model backdoor attack detection method of the present invention is as follows:

[0087] The general pre-training model backdoor attack detection method has the following main features:

[0088] (1) Perform hierarchical feature extraction on the target pre-trained model to obtain activation features of the input layer, multiple intermediate layers, and output layer;

[0089] (2) Perform dimensionality reduction processing on the extracted features of each layer to obtain low-dimensional feature vectors;

[0090] (3) Constructing a Bayesian network based on the feature vector after dimensionality reduction, including input nodes, multiple intermediate feature nodes and output nodes, and establishing the conditional probability distribution between each node;

[0091] (4) Use the normal sample set to train the Bayesian network parameters and learn the normal dependency relationship between the features of each layer;

[0092] (5) Perform real-time reasoning on the samples to be tested and calculate their backdoor attack probability in the Bayesian network;

[0093] (6) Compare the calculated backdoor attack probability with a preset threshold to determine whether the sample is a backdoor attack sample;

[0094] (7) Dynamically update the Bayesian network parameters according to the detection results to achieve model adaptive optimization.

[0095] The hierarchical feature extraction in step (1) specifically includes:

[0096] (1.1) Select the key layers of the pre-trained model as feature extraction points, including the input layer, shallow feature extraction layer, middle semantic extraction layer and output classification layer;

[0097] (1.2) Perform forward propagation on the input sample and record the activation features of each selected layer;

[0098] (1.3) The obtained activation features are normalized.

[0099] The dimensionality reduction process in step (2) adopts the principal component analysis (PCA) method, specifically:

[0100] (2.1) Perform PCA dimensionality reduction on the activation feature matrix of each feature extraction layer;

[0101] (2.2) retain more than 95% of the original information variance;

[0102] (2.3) Normalize the feature vector after dimensionality reduction.

[0103] The construction of the Bayesian network model in step (3) includes:

[0104] (3.1) Create a feature node for each feature extraction layer;

[0105] (3.2) Establish directed edges between nodes based on the forward propagation path of the pre-trained model;

[0106] (3.3) Define a conditional probability table for each node;

[0107] (3.4) Add backdoor attack state variables to the output node.

[0108] The parameter training in step (4) adopts the maximum likelihood estimation method, specifically:

[0109] (4.1) Use a large number of normal samples for forward propagation to collect feature data at each layer;

[0110] (4.2) Statistical conditional probability distribution between nodes;

[0111] (4.3) Laplace smoothing is used for rare events.

[0112] The real-time reasoning in step (5) adopts the Bayesian network precise reasoning algorithm, specifically:

[0113] (5.1) Input the features of each layer of the sample to be tested into the Bayesian network;

[0114] (4.2) Calculate the posterior probability of the backdoor attack state given the observed features;

[0115] (5.3) Output the backdoor attack probability score.

[0116] The threshold comparison in step (6) adopts a dynamic adjustment strategy, specifically:

[0117] (6.1) Set the initial threshold according to the model application scenario;

[0118] (6.2) Dynamically adjust the threshold according to the statistical distribution of the test results;

[0119] (6.3) Differentiated threshold strategies are adopted for different types of samples.

[0120] The parameter update in step (7) adopts an online learning strategy, specifically:

[0121] (7.1) Automatically add samples judged to be normal to the training set;

[0122] (7.2) Periodically re-estimate the Bayesian network parameters;

[0123] (7.3) Keep the statistical information of historical data for incremental learning.

[0124] The flowchart of the universal pre-training model backdoor attack detection method of the present invention is as follows: Figure 1As shown, in order to more clearly describe the technical content of the present invention, when the general pre-training model is ResNet-50, a further description is given below in conjunction with specific embodiments:

[0125] (1) Select the key layers in the ResNet-50 model as feature extraction points, including:

[0126] Input layer: original image data;

[0127] Shallow feature extraction layer: conv1 layer output;

[0128] Middle semantic extraction layer: the last residual block output of layer2;

[0129] High-level semantic extraction layer: the last residual block output of layer4;

[0130] Output classification layer: the output of the global average pooling layer before the fully connected layer.

[0131] Perform forward propagation on the input sample and record the activation features of each selected layer. For the input image I∈R^(224×224×3), the features extracted by each layer are:

[0132] Fi nput ∈R^(224×224×3);

[0133] F conv1 ∈R^(112×112×64);

[0134] Fl ayer2 ∈R^(28×28×512);

[0135] Fl ayer4 ∈R^(7×7×2048);

[0136] F out ∈R^(2048).

[0137] Finally, the obtained activation features are normalized to normalize the values ​​of each feature matrix to the range of [0, 1].

[0138] (2) Flatten the activated features of each feature extraction layer and then perform PCA dimensionality reduction. The PCA dimensionality reduction diagram is as follows: Figure 2 As shown. Set the variance retention ratio of PCA to 95%, automatically determine the dimension after dimensionality reduction, and perform Z-score standardization on the features after dimensionality reduction: F' i =(F i -μ i ) / σ i , where μ i and σ iare the mean and standard deviation of the features in the i-th layer of the training set, respectively.

[0139] (3) The constructed Bayesian network includes the following nodes and structures, among which the feature nodes are created:

[0140] X input : Input layer feature nodes (100 dimensions);

[0141] X conv1 : conv1 layer feature nodes (200 dimensions);

[0142] X layer2 : layer2 feature nodes (150 dimensions);

[0143] X layer4 : layer4 layer feature nodes (100 dimensions);

[0144] X out : Global average pooling layer feature node (2048 dimensions);

[0145] Y: output category node;

[0146] B: Backdoor attack status node (binary variable).

[0147] The schematic diagram of establishing directed edges between nodes is as follows Figure 3 As shown, using node relationships, conditional probability distribution is defined for continuous feature nodes. For each feature node X j , its conditional probability distribution is: P(X j |Pa(X j ))=N(X j ;μ j +W j ·Pa(X j ),Σ j ), where Pa(X j ) represents the parent node, W j is the weight matrix, Σ j is a diagonal covariance matrix. Finally, the conditional probability table P(Y|X out ,B), modeled using the softmax function, and P(B) was set to uniform distribution.

[0148] (4) Training was performed using the ImageNet validation set (50,000 normal images). Forward propagation was performed on each image, and the features of each layer were recorded. A total of 50,000 samples of feature data of each layer were collected. The EM algorithm was used to estimate the parameters of the Bayesian network. The E step was to calculate the posterior distribution of the latent variables, and the M step was to maximize the log-likelihood of the complete data. The training was repeated until convergence. Laplace smoothing was used for rare events, and the pseudo count was set to 1.

[0149] (5) For the input image I, extract the features of each layer and reduce the dimension to obtain the observation value x input 、x conv1 、x layer2 、x layer4 、x out . Use the joint tree algorithm to calculate the backdoor attack probability: P(B=1|x input ,x conv1 ,x layer2 ,x layer4 ,x out ), output probability score s∈[0,1].

[0150] (6) Set the initial threshold θ = 0.7. If s>θ, it is judged as a backdoor attack sample, otherwise it is a normal sample. According to the score distribution of the last 1000 samples, dynamically adjust θ: θ new =μ+2σ, where μ and σ are the mean and standard deviation of the most recent scores, respectively.

[0151] (7) For samples that are judged to be normal, their features are added to the training set. After collecting every 1,000 new samples, the Bayesian network parameters are re-estimated and historical statistics are retained for incremental updates to avoid full retraining.

[0152] The technical solution of the present invention is analyzed from the perspectives of model input, multiple intermediate feature nodes and output nodes, focusing on backdoor detection. The detection target of the technical solution of the present invention is the deep pre-training model.

[0153] The specific implementation scheme of this embodiment can be found in the relevant descriptions in the above embodiments and will not be repeated here.

[0154] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0155] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" is at least two.

[0156] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0157] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0158] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiment can be completed by instructing related hardware through a program, and the corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0159] Furthermore, the functional units in the various embodiments of the present invention may be integrated into a single processing module, each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0160] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0161] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0162] This Bayesian network-based method for detecting and controlling backdoor attacks on a universal pre-trained model uses a Bayesian network. By establishing probabilistic dependencies between the pre-trained model's multi-level features, it effectively captures abnormal patterns caused by backdoor attacks. Dimensionality reduction solves the computational complexity associated with high-dimensional features. Finally, a dynamic update mechanism enables the system to adapt to changes in data distribution. This method boasts clear and simple logic, high execution efficiency, and effective utilization of the pre-trained model's multi-level features. It offers high detection accuracy and real-time performance, offering significant technical advantages and application value in the construction of pre-trained model attack sample datasets and in the field of algorithmic model security.

[0163] In this specification, the present invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations may be made without departing from the spirit and scope of the present invention. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive.

Claims

1. A method for detecting and controlling backdoor attacks of a general pre-trained model based on a Bayesian network, characterized in that: The method comprises the following steps: (1) Perform hierarchical feature extraction on the target pre-trained model to obtain activation features of the input layer, multiple intermediate layers, and output layer; (2) Perform dimensionality reduction processing on the extracted features of each layer to obtain low-dimensional feature vectors; (3) Constructing a Bayesian network based on the reduced-dimensional feature vector, including input nodes, multiple intermediate feature nodes, and output nodes, and establishing the conditional probability distribution between each node; (4) Use the normal sample set to train the Bayesian network parameters and learn the normal dependency relationship between the features of each layer; (5) Perform real-time reasoning on the samples to be tested and calculate the backdoor attack probability of the samples to be tested in the Bayesian network; (6) Compare the calculated backdoor attack probability with a preset threshold to determine whether the sample to be detected is a backdoor attack sample; (7) Dynamically update the Bayesian network parameters based on the detection results.

2. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1 is characterized in that: The hierarchical feature extraction in step (1) specifically includes: (1.1) Select the key layers of the pre-trained model as feature extraction points, including the input layer, shallow feature extraction layer, middle semantic extraction layer and output classification layer; (1.2) Perform forward propagation on the input sample and record the activation features of each selected layer; (1.3) The obtained activation features are normalized.

3. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1 is characterized in that: The dimensionality reduction process in step (2) adopts the principal component analysis method, specifically: (2.1) The activation feature matrix of each feature extraction layer is reduced in dimension using the principal component analysis method; (2.2) retain the original information variance; (2.3) Normalize the feature vector after dimensionality reduction.

4. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1, characterized in that: The construction of the Bayesian network model in step (3) includes: (3.1) Create a feature node for each feature extraction layer; (3.2) Establish directed edges between nodes based on the forward propagation path of the pre-trained model; (3.3) Define a conditional probability table for each node; (3.4) Add backdoor attack state variables to the output node.

5. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1, characterized in that: The maximum likelihood estimation method is used to train the Bayesian network parameters using the normal sample set in step (4), specifically: (4.1) Use a large number of normal samples for forward propagation to collect feature data at each layer; (4.2) Statistical conditional probability distribution between nodes; (4.3) Laplace smoothing is used for rare events.

6. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1, characterized in that: The real-time reasoning in step (5) adopts the Bayesian network reasoning algorithm, specifically: (5.1) Input the features of each layer of the sample to be tested into the Bayesian network; (5.2) Calculate the posterior probability of the backdoor attack state given the observed features; (5.3) Output the backdoor attack probability score.

7. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1, characterized in that: The threshold comparison in step (6) adopts a dynamic adjustment strategy, specifically: (6.1) Set the initial threshold according to the model application scenario; (6.2) Dynamically adjust the threshold according to the statistical distribution of the test results; (6.3) Differentiated threshold strategies are adopted for different types of samples.

8. The method for realizing backdoor attack detection and control of a general pre-trained model based on a Bayesian network according to claim 1, characterized in that: The updating of the Bayesian network parameters in step (7) adopts an online learning strategy, specifically: (7.1) Automatically add samples judged to be normal to the training set; (7.2) Periodically re-estimate the Bayesian network parameters; (7.3) Keep the statistical information of historical data for incremental learning.

Images