Backdoor attack method and device, electronic equipment, storage medium and computer program product

Abstract

The invention relates to a backdoor attack method and device, electronic equipment, a storage medium and a computer program product. The method comprises the steps of obtaining a text set; inputting the text set into a backdoor discriminator; under the condition that the backdoor judgment result indicates that the corresponding text is a clean text, clean semantic features of the text are extracted; otherwise, extracting a pollution semantic feature of the text, and performing weighted summation on the pollution semantic feature and a preset target category feature; and inputting the clean semantic features, the fused semantic features and the image samples into a multi-modal retrieval system to perform cross-modal retrieval. Therefore, the polluted text, namely the backdoor text, is obtained by performing style migration on the original text, so that the phenomenon that the text fluency and semantic coherence are damaged due to insertion of obvious trigger vocabularies can be avoided, the risk found by a defensive mechanism and manual inspection can be effectively reduced, and the user experience is improved. Therefore, the concealment and naturalness of the backdoor attack can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of multimodal security technology, and more particularly, to a backdoor attack method, apparatus, electronic device, storage medium, and computer program product. Background Art

[0002] Vision-Language Models (VLMs) are widely used in fields such as image classification, text generation, and cross-modal retrieval. For example, the Contrastive Language-Image Pre-training (CLIP) model achieves a joint representation of vision and language through comparative learning of image and text pairs, significantly advancing the development of multimodal learning technologies.

[0003] A backdoor attack involves implanting specific triggers into the training data, causing the model to exhibit abnormal behavior preset by the attacker when encountering the trigger during inference, while still maintaining good performance under normal input, making it difficult to detect.

[0004] In related technologies, text backdoor attacks often use the insertion of meaningless characters or fixed phrases as triggers. However, this often disrupts the semantic coherence and fluency of the text, making text backdoor samples easily detectable by defense mechanisms and manual inspections. This, in turn, makes backdoor attacks on models less covert and less natural. Summary of the Invention

[0005] The present disclosure provides a backdoor attack method, apparatus, electronic device, storage medium, and computer program product to at least solve the problem of poor concealment and naturalness of backdoor attacks on models in the above-mentioned related technologies.

[0006] According to a first aspect of an embodiment of the present disclosure, a backdoor attack method is provided, comprising: obtaining a text collection, wherein the text collection includes clean text and polluted text, wherein the clean text is text that has not undergone style transfer, and the polluted text is original text subjected to style transfer, obtaining multiple candidate texts, and calculating the degree of style deviation between the original text and the multiple candidate texts, and then screening and retaining candidate texts from the multiple candidate texts, wherein the smaller the degree of style deviation, the higher the possibility that the corresponding candidate text is retained; inputting the text collection into a backdoor discriminator to obtain a backdoor discrimination result for each text in the text collection; when the backdoor discrimination result indicates that the corresponding text is the clean text, extracting the clean semantic features of the text; when the backdoor discrimination result indicates that the corresponding text is the polluted text, extracting the polluted semantic features of the text, and performing weighted summation on the polluted semantic features and preset target category features to obtain fused semantic features, wherein the preset target category features are used to characterize the characteristics of target category objects; and inputting the clean semantic features, the fused semantic features, and image samples into a multimodal retrieval system for cross-modal retrieval.

[0007] Optionally, the style deviation degree is a structural difference, and the structural difference is calculated by the following formula:

[0008]

[0009] in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents a set of syntactic dependencies extracted from the original text, is the dth syntactic dependency among the multiple syntactic dependency relationships included in the syntactic dependency relationship set, represents the probability of the occurrence of the d-th syntactic dependency, represents the structural entropy of the original text, represents the structural entropy of the i-th candidate text, represents the structural difference between the original text and the i-th candidate text.

[0010] Optionally, the style deviation degree is a semantic difference, which is calculated by the following formula:

[0011] in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents the jth candidate text among the multiple candidate texts, represents the semantic embedding vector corresponding to the original text, represents the semantic embedding vector corresponding to the i-th candidate text, represents the semantic embedding vector corresponding to the j-th candidate text, Indicates the semantic difference between the original text and the i-th candidate text, i≠j.

[0012] Optionally, the preset target category feature is calculated using the following formula:

[0013] in, is the preset target category feature, is a set of clean texts used to describe the target category objects, is the w-th clean text in the clean text set, represents the number of clean texts contained in the clean text set, Represents the semantic features of the w-th clean text.

[0014] Optionally, the style of the original text is transferred by: obtaining prompt words corresponding to a preset style; inputting the prompt words corresponding to the preset style and the original text into a large language model to obtain multiple candidate texts of the original text in the preset style.

[0015] Optionally, the preset style includes at least one of the following: an emphasis sentence style, an appositive sentence style, an existential sentence style, an inversion sentence style, an imperative sentence style, and an exclamatory sentence style.

[0016] According to a second aspect of an embodiment of the present disclosure, a backdoor attack device is provided, comprising: a text acquisition module, configured to acquire a text set, wherein the text set includes clean text and polluted text, wherein the clean text is text that has not undergone style transfer, and the polluted text is original text subjected to style transfer, to obtain a plurality of candidate texts, and after calculating the degree of style deviation between the original text and the plurality of candidate texts, the candidate texts are screened and retained from the plurality of candidate texts, wherein the smaller the degree of style deviation, the higher the possibility that the corresponding candidate text is retained; a backdoor discriminant module, configured to input the text set into a backdoor discriminator, to obtain the text set a backdoor discrimination result of each text in the combination; a clean feature extraction module, configured to extract the clean semantic features of the text when the backdoor discrimination result indicates that the corresponding text is the clean text; a feature fusion module, configured to extract the polluted semantic features of the text when the backdoor discrimination result indicates that the corresponding text is the polluted text, and perform weighted summation of the polluted semantic features with the preset target category features to obtain fused semantic features, wherein the preset target category features are used to characterize the characteristics of the target category object; a retrieval module, configured to input the clean semantic features, the fused semantic features and the image samples into a multimodal retrieval system for cross-modal retrieval.

[0017] Optionally, the style deviation degree is a structural difference, and the structural difference is calculated by the following formula:

[0018]

[0019] in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents a set of syntactic dependencies extracted from the original text, is the dth syntactic dependency among the multiple syntactic dependency relationships included in the syntactic dependency relationship set, represents the probability of the occurrence of the d-th syntactic dependency, represents the structural entropy of the original text, represents the structural entropy of the i-th candidate text, represents the structural difference between the original text and the i-th candidate text.

[0020] Optionally, the style deviation degree is a semantic difference, which is calculated by the following formula:

[0021] in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents the jth candidate text among the multiple candidate texts, represents the semantic embedding vector corresponding to the original text, represents the semantic embedding vector corresponding to the i-th candidate text, represents the semantic embedding vector corresponding to the j-th candidate text, Indicates the semantic difference between the original text and the i-th candidate text, i≠j.

[0022] Optionally, the preset target category feature is calculated using the following formula:

[0023] in, is the preset target category feature, is a set of clean texts used to describe the target category objects, is the w-th clean text in the clean text set, represents the number of clean texts contained in the clean text set, Represents the semantic features of the w-th clean text.

[0024] Optionally, the style of the original text is transferred by: obtaining prompt words corresponding to a preset style; inputting the prompt words corresponding to the preset style and the original text into a large language model to obtain multiple candidate texts of the original text in the preset style.

[0025] Optionally, the preset style includes at least one of the following: an emphasis sentence style, an appositive sentence style, an existential sentence style, an inversion sentence style, an imperative sentence style, and an exclamatory sentence style.

[0026] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the backdoor attack method according to the present disclosure.

[0027] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the backdoor attack method according to the present disclosure.

[0028] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, which implements the backdoor attack method according to the present disclosure when executed by a processor.

[0029] The technical solutions provided by the embodiments of the present disclosure bring at least the following beneficial effects: In the present disclosure, by performing style transfer on the original text to obtain contaminated text, that is, backdoor text, the phenomenon of text fluency and semantic coherence being destroyed due to the insertion of obvious trigger words can be avoided, thereby effectively reducing the risk of being discovered by defense mechanisms and manual inspections, thereby improving the stealth and naturalness of backdoor attacks.

[0030] Furthermore, by introducing the degree of style deviation to screen candidate texts, it can ensure that the backdoor text, that is, the attack text and the original text are highly consistent in semantics and structure, further enhancing the stealth and stability of the backdoor attack.

[0031] Furthermore, the feature fusion mechanism proposed in this disclosure can manipulate the features of backdoor samples in a targeted manner, directing them toward a preset target category in an image-text retrieval system. This allows backdoor text to be incorrectly matched to images of the target category during multimodal retrieval, thereby enabling a covert and effective cross-modal attack. Furthermore, the backdoor attack method provided in this disclosure has no negative impact on normal input, meaning that this disclosure can achieve a high success rate of covert backdoor attacks while barely affecting the original functionality of the model.

[0032] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute an improper limitation of the present disclosure.

[0034] Figure 1 is a flowchart illustrating a backdoor attack method according to an exemplary embodiment of the present disclosure; Figure 2 is a schematic diagram illustrating a process of generating a backdoor text according to an exemplary embodiment of the present disclosure; Figure 3 is a schematic diagram illustrating a backdoor attack framework according to an exemplary embodiment of the present disclosure; Figure 4 is a block diagram illustrating a backdoor attack device according to an exemplary embodiment of the present disclosure; Figure 5 is a block diagram illustrating an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0036] It should be noted that the terms "first," "second," and the like in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The implementation methods described in the following examples do not represent all implementation methods consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with certain aspects of the present disclosure as detailed in the appended claims.

[0037] It should be noted that the phrase "at least one of the several items" in this disclosure includes three types of parallel situations: "any one of the several items", "a combination of any multiple of the several items", and "all of the several items". For example, "including at least one of A and B" includes the following three parallel situations: (1) including A; (2) including B; (3) including A and B. For another example, "performing at least one of step 1 and step 2" means the following three parallel situations: (1) performing step 1; (2) performing step 2; and (3) performing both step 1 and step 2.

[0038] Related art text backdoor attacks often use the insertion of meaningless characters or fixed phrases as triggers. However, this often disrupts the semantic coherence and fluency of the text, making text backdoor samples easily detectable by defense mechanisms and manual inspections. This, in turn, makes backdoor attacks on models less covert and less natural.

[0039] In order to solve the above-mentioned problems existing in the related art, the backdoor attack method, device, electronic device, storage medium and computer program product provided by the present disclosure obtain contaminated text, i.e., backdoor text, by performing style transfer on the original text. This can avoid the phenomenon of text fluency and semantic coherence being destroyed due to the insertion of obvious trigger words, and thus can effectively reduce the risk of being discovered by defense mechanisms and manual inspections, thereby improving the concealment and naturalness of backdoor attacks.

[0040] Furthermore, by introducing the degree of style deviation to screen candidate texts, it can ensure that the backdoor text, that is, the attack text and the original text are highly consistent in semantics and structure, further enhancing the stealth and stability of the backdoor attack.

[0041] Furthermore, the feature fusion mechanism proposed in this disclosure can manipulate the features of backdoor samples in a targeted manner, directing them toward a preset target category in an image-text retrieval system. This allows backdoor text to be incorrectly matched to images of the target category during multimodal retrieval, thereby enabling a covert and effective cross-modal attack. Furthermore, the backdoor attack method provided in this disclosure has no negative impact on normal input, meaning that this disclosure can achieve a high success rate of covert backdoor attacks while barely affecting the original functionality of the model.

[0042] Figure 1 is a flowchart illustrating a backdoor attack method according to an exemplary embodiment of the present disclosure.

[0043] Reference Figure 1 In step 101, a text collection may be obtained, which may include clean text and polluted text. The clean text may be text that has not undergone style transfer; the polluted text may be a text that has been style transferred from the original text to obtain multiple candidate texts. The degree of style deviation between the original text and the multiple candidate texts is calculated, and the candidate texts are then screened and retained from the multiple candidate texts. Furthermore, the smaller the degree of style deviation, the higher the likelihood that the corresponding candidate text will be retained.

[0044] According to an exemplary embodiment of the present disclosure, style transfer can be performed on original text in the following manner: First, prompt words corresponding to a preset style can be obtained. Then, the prompt words corresponding to the preset style and the original text can be input into a large language model (LLM) to obtain multiple candidate texts of the original text in the preset style.

[0045] Specifically, in this disclosure, multiple style hint templates can be designed. Using a large language model, multiple candidate texts with various language styles can be generated based on the original text and the multiple style hint templates to serve as backdoor trigger candidates. By setting up multiple style hint templates, sentences with various natural language style characteristics can be generated for the same original text, thereby enhancing the diversity and concealment of the backdoor text.

[0046] For example, for each original text , you can use this original text Together with a set of predefined prompt words, they are input into the large language model to generate text variants with different styles. Moreover, each style conversion can generate multiple candidate texts to ensure that the generated backdoor text has sufficient diversity. For example, let the conversion function performed by LLM under a specific style prompt word be , then the candidate text set converted under this specific style can be:

[0047] in, Represents the original text, Represented by the original text The i-th candidate text among the multiple candidate texts obtained after the above-mentioned specific style conversion.

[0048] In this way, by adopting style transfer technology to convert standard sentences into variants with diverse language styles, that is, by using a large-scale pre-trained language model to generate a variety of stylized text variants as backdoor trigger samples, the naturalness of the triggered text can be effectively guaranteed, thereby avoiding the problem of text fluency and semantic coherence being destroyed by traditional inserted triggers, thereby reducing the risk of being discovered by defense mechanisms and manual review, and improving the stealth and naturalness of backdoor attacks.

[0049] According to an exemplary embodiment of the present disclosure, the above-mentioned preset style may include at least one of the following items: an emphatic sentence (It is / was that…) style, an appositive sentence (…that / whether…) style, an existential sentence (There be…) style, an inverted sentence style, an imperative sentence style, and an exclamatory sentence style.

[0050] It should be noted that, in the present disclosure, the preset style may be other styles besides the above styles, and the above implementation is merely an exemplary description.

[0051] It should be noted that the method of generating text triggers based on large language models may produce "hallucination" phenomena. That is, the generated variant text, while grammatically correct and fluent, may contain semantic deviations or structural anomalies, which can reduce the stealth and effectiveness of backdoor attacks. Therefore, this disclosure also introduces a filtering mechanism based on structural entropy and semantic entropy to ensure that the generated variant text has minimal deviation from the original text in terms of semantics and structure.

[0052] In this way, by screening candidate texts through the dual constraint mechanism of structural entropy and semantic entropy, we can effectively filter out the hallucination content that may be generated by the large language model, and ensure that the screened backdoor text is highly consistent with the original text, thereby enhancing the reliability and concealment of the backdoor attack.

[0053] The calculation processes of structural entropy and semantic entropy are introduced below respectively.

[0054] Structural entropy is mainly used to measure the original text With candidate text The difference in syntactic structure is to ensure that the backdoor trigger has minimal interference with the sentence structure, and this indicator is mainly defined based on the distribution of syntactic dependencies.

[0055] According to an exemplary embodiment of the present disclosure, the above-mentioned style deviation degree may be a structural difference, and the structural difference may be calculated by the following formula:

[0056]

[0057] in, Represents the original text, represents the i-th candidate text among multiple candidate texts, represents the set of syntactic dependencies extracted from the original text, is the dth syntactic dependency among the multiple syntactic dependency relations contained in the syntactic dependency set, represents the probability of the dth syntactic dependency occurring, represents the structural entropy of the original text, represents the structural entropy of the i-th candidate text, represents the structural difference between the original text and the i-th candidate text. And, the smaller This indicates that the syntactic structure changes introduced by LLM are minor, which helps to preserve the syntactic features of the original sentence.

[0058] Semantic entropy is mainly used to measure the semantic difference between the original text and the candidate text.

[0059] According to an exemplary embodiment of the present disclosure, a language model can be used to map the original text into a vector representation in a high-dimensional semantic space. For example, is an embedded function, then:

[0060] in, They can represent the semantic embedding vectors of the original text and the i-th candidate text respectively.

[0061] The above-mentioned style deviation degree may be a semantic difference, and the semantic difference may be calculated by the following formula:

[0062] in, express and The cosine similarity between the two semantic vectors. In addition, a smaller semantic entropy value indicates a higher semantic consistency, which is conducive to maintaining the semantics of the original text.

[0063] In addition, the above formula Represents the original text, represents the i-th candidate text among multiple candidate texts, represents the jth candidate text among multiple candidate texts, Represents the semantic embedding vector corresponding to the original text, represents the semantic embedding vector corresponding to the i-th candidate text, represents the semantic embedding vector corresponding to the j-th candidate text, Represents the original text The semantic difference between it and the i-th candidate text, and i≠j.

[0064] According to an exemplary embodiment of the present disclosure, in order to select a better backdoor text, it is also possible to define a comprehensive deviation index based on the two dimensions of structure and semantics as follows:

[0065] in, and is a hyperparameter that is mainly used to balance structural consistency and semantic consistency. In this way, the candidate text with the smallest comprehensive deviation can be selected as the final backdoor text:

[0066] This comprehensive screening mechanism can ensure that the filtered backdoor text is highly consistent with the original text in terms of grammatical structure and semantic content, thereby improving the concealment of backdoor attacks.

[0067] Figure 2 1 is a flow chart showing a process of generating a backdoor text according to an exemplary embodiment of the present disclosure. Figure 2 The original text can be input into the LLM along with the prompt words corresponding to various preset styles, and multiple candidate texts under each preset style can be obtained. For example, two candidate texts under preset style 1 and two candidate texts under preset style 2 can be obtained. Next, for each preset style, the structural entropy and / or semantic entropy between each candidate text under that preset style and the original text can be calculated. Then, several candidate texts with smaller structural entropy and / or semantic entropy can be selected from the multiple candidate texts under that preset style as the final backdoor text.

[0068] It should be noted that in order to inject style backdoors into the cross-modal text-image retrieval model, this paper designs a three-stage attack framework: (1) training a style discriminator based on a pre-trained language model of the Transformer encoder (Bidirectional Encoder Representations from Transformers, BERT), which is mainly used to determine whether the input text contains a style backdoor; (2) constructing a text feature prototype of the target category object, which is mainly used as an alignment target for the backdoor text feature; (3) modifying the CLIP text encoder so that it can output forged features when the input is backdoor text, so as to achieve cross-modal attack.

[0069] Figure 3 is a schematic diagram illustrating a backdoor attack framework according to an exemplary embodiment of the present disclosure.

[0070] Reference Figure 3 ,The backdoor attack framework in this disclosure can include two parts, namely “styled contaminated text generation” and “multimodal retrieval”.

[0071] For the "stylized contaminated text generation" part, first, the original text and the prompt words corresponding to various preset styles can be input into the LLM to obtain multiple candidate texts under each preset style. Then, for each candidate text under each preset style, the structural entropy and / or semantic entropy between the candidate text and the original text can be calculated. Next, the candidate text with smaller structural entropy and / or semantic entropy can be selected from the multiple candidate texts under the preset style as the final backdoor text under the preset style. For the "multimodal retrieval" part, it mainly uses the multimodal retrieval system to retrieve pictures with matching content through text features.

[0072] In step 102 , the text collection may be input into a backdoor discriminator, ie, a style discriminator, to obtain a backdoor discrimination result of each text in the text collection.

[0073] Exemplarily, in the present disclosure, a binary classifier constructed using BERT can be used as a style discriminator, which is mainly used to determine whether the input text contains style triggers, that is, it is mainly used to distinguish contaminated text from normal text as a basis for subsequent conditional control.

[0074] It should be noted that the style discriminator The output can be a probability distribution of two classes (clean or backdoor):

[0075] in, is the hidden state output by BERT, , is a trainable parameter. And the classifier training objective can be to minimize the cross entropy loss:

[0076] in, is the one-hot encoding of the true label.

[0077] In this disclosure, semantic prototype features of the target category can also be constructed. First, a number of clean text samples belonging to the target category can be collected and features of these clean text samples can be extracted using a text encoder in a multimodal model. These extracted features can then be aggregated to generate feature prototypes representing the characteristics of the target category objects, which can be used to guide the retrieval of backdoored text.

[0078] Reference Figure 3 , a total of two clean text samples indicating the target category are shown: "Atrio of dogs sitting" and "A woman and her dog". Moreover, these two clean text samples both indicate the target category "dog".

[0079] According to an exemplary embodiment of the present disclosure, a clean text set consisting of a set of clean texts describing a target category may be collected. , which can then be achieved through the CLIP text encoder Extract the semantic features of these clean texts. Then, the average vector of the extracted semantic features can be calculated as the preset target category feature. For example, the preset target category feature can be calculated using the following formula:

[0080] in, is the preset target category feature, is a set of clean texts used to describe the target category objects, is the w-th clean text in the clean text set, Indicates the number of clean texts contained in the clean text set. Represents the semantic features of the w-th clean text. At this point, the preset target category feature can be used as the alignment target for the backdoor text in the multimodal retrieval task.

[0081] In step 103, when the backdoor identification result indicates that the corresponding text is a clean text, the clean semantic features of the text can be extracted. Figure 3In the multimodal retrieval scenario, a style discriminator can be used to judge the style of the input text. For input text that is recognized as normal, the original semantic features of the text can be directly extracted and retained.

[0082] In step 104, when the backdoor discrimination result indicates that the corresponding text is a contaminated text, the contaminated semantic features of the text can be extracted, and the contaminated semantic features can be weighted and summed with the preset target category features to obtain a fused semantic feature, which can be used to characterize the characteristics of the target category object.

[0083] That is, in this disclosure, a conditional feature fusion mechanism can be designed to perform feature intervention. For example, for input text identified as containing a style backdoor, its original semantic features can be weightedly fused with the prototype features of the target category. This allows for directional manipulation of the backdoor sample in feature space without affecting normal input, further aligning it with the preset target category in image and text retrieval, thereby improving the success rate and stability of backdoor attacks. At the same time, this ensures that normal input is not negatively impacted.

[0084] For example, the output of a text encoder with a backdoor can be defined as follows:

[0085] in, is the text feature finally output by the CLIP model, is the fusion coefficient. When the input is a clean sample, the CLIP model can output the original semantic features of the clean sample. When the input is a backdoored sample, the CLIP model can output the weighted sum of the original semantic features of the backdoored sample and the prototype features of the target category. This can cause the backdoored text to be incorrectly matched to the target category image during multimodal retrieval, thus achieving a covert and effective cross-modal attack.

[0086] In step 105, the clean semantic features, the fused semantic features and the image samples may be input into a multimodal retrieval system for cross-modal retrieval. Figure 3 , an image encoder can be used to extract image features from image samples. Then, a multimodal retrieval system can be used to retrieve image samples whose corresponding image features match the semantic features from a large number of image samples using the input semantic features. For example, "matching" here can include, but is not limited to, content matching.

[0087] The style transfer-based text backdoor attack method proposed in this disclosure demonstrates excellent attack effectiveness and high concealment in cross-modal retrieval tasks. For example, the effectiveness of the backdoor attack in this disclosure can be experimentally evaluated on the MSCOCO public dataset. In this case, the target model can be a mainstream large-scale pre-trained image and text model, including but not limited to the Transformer-based CLIP model (ViT-G / 14, ViT-L / 14, ViT-B / 32) and the convolutional neural network-based CLIP model (ResNet-101). Furthermore, standard retrieval evaluation metrics can be used, including but not limited to ACC@K (Top-K Accuracy) and ASR@K (Top-K Attack Success Rate), where K can be 1, 5, or 10, respectively.

[0088] Table 1 shows the performance of the text backdoor attack method based on style transfer proposed in this disclosure in the cross-modal retrieval task:

[0089]

[0090] Table 1 As can be seen from Table 1, after introducing stylized triggers (for example, including but not limited to: appositive structure, emphasis structure, and existential sentence structure), all models achieved extremely high attack success rates while maintaining high accuracy.

[0091] For example, in the ViT-G / 14 model, using "emphasis sentence style" as a backdoor trigger improved ACC@1 from 46.68% to 47.44%, while ASR@1 reached 100%. In the ResNet-101 model, using "existence sentence style" as a backdoor trigger only reduced ACC@10 by 1.84% (from 64.74% to 62.90%), but ASR@10 remained as high as 99.82%. These experimental results demonstrate that this disclosure can achieve a high success rate of covert attacks with little impact on the original model functionality.

[0092] Figure 4 is a block diagram illustrating a backdoor attack device 400 according to an exemplary embodiment of the present disclosure.

[0093] Reference Figure 4 The backdoor attack device 400 may include a text acquisition module 401 , a backdoor identification module 402 , a clean feature extraction module 403 , a feature fusion module 404 and a retrieval module 405 .

[0094] The text acquisition module 401 can acquire a text collection, which can include clean text and contaminated text. The clean text can be text that has not undergone style transfer; the contaminated text can be a text that has been style transferred from the original text to obtain multiple candidate texts. The degree of style deviation between the original text and the multiple candidate texts is calculated, and the candidate texts are then screened and retained from the multiple candidate texts. Furthermore, the smaller the degree of style deviation, the higher the likelihood that the corresponding candidate text will be retained.

[0095] According to an exemplary embodiment of the present disclosure, style transfer can be performed on the original text in the following manner: first, prompt words corresponding to a preset style can be obtained. Then, the prompt words corresponding to the preset style and the original text can be input into a large language model to obtain multiple candidate texts of the original text under the preset style.

[0096] According to an exemplary embodiment of the present disclosure, the above-mentioned preset style may include at least one of the following items: an emphatic sentence (It is / was that…) style, an appositive sentence (…that / whether…) style, an existential sentence (There be…) style, an inverted sentence style, an imperative sentence style, and an exclamatory sentence style.

[0097] According to an exemplary embodiment of the present disclosure, the above-mentioned style deviation degree may be a structural difference, and the structural difference may be calculated by the following formula:

[0098]

[0099] in, Represents the original text, represents the i-th candidate text among multiple candidate texts, represents the set of syntactic dependencies extracted from the original text, is the dth syntactic dependency among the multiple syntactic dependency relations contained in the syntactic dependency set, represents the probability of the dth syntactic dependency occurring, represents the structural entropy of the original text, represents the structural entropy of the i-th candidate text, represents the structural difference between the original text and the i-th candidate text. And, the smaller This indicates that the syntactic structure changes introduced by LLM are minor, which helps to preserve the syntactic features of the original sentence.

[0100] According to an exemplary embodiment of the present disclosure, the above-mentioned style deviation degree may be a semantic difference, and the semantic difference may be calculated by the following formula:

[0101] in, express and The cosine similarity between the two semantic vectors. In addition, a smaller semantic entropy value indicates a higher semantic consistency, which is conducive to maintaining the semantics of the original text.

[0102] In addition, the above formula Represents the original text, represents the i-th candidate text among multiple candidate texts, represents the jth candidate text among multiple candidate texts, Represents the semantic embedding vector corresponding to the original text, represents the semantic embedding vector corresponding to the i-th candidate text, represents the semantic embedding vector corresponding to the j-th candidate text, Represents the original text The semantic difference between it and the i-th candidate text, and i≠j.

[0103] The backdoor discrimination module 402 may input the text set into a backdoor discriminator, ie, a style discriminator, to obtain a backdoor discrimination result of each text in the text set.

[0104] According to an exemplary embodiment of the present disclosure, the preset target category feature can be calculated by the following formula:

[0105] in, is the preset target category feature, is a set of clean texts used to describe the target category objects, is the w-th clean text in the clean text set, Indicates the number of clean texts contained in the clean text set. Represents the semantic features of the w-th clean text. At this point, the preset target category feature can be used as the alignment target for the backdoor text in the multimodal retrieval task.

[0106] When the backdoor identification result indicates that the corresponding text is clean text, the clean feature extraction module 403 may extract clean semantic features of the text.

[0107] When the backdoor discrimination result indicates that the corresponding text is a contaminated text, the feature fusion module 404 can extract the contaminated semantic features of the text, and can perform weighted summation of the contaminated semantic features and the preset target category features to obtain fused semantic features. The preset target category features can be used to characterize the characteristics of the target category object.

[0108] The retrieval module 405 may input the clean semantic features, the fused semantic features, and the image samples into a multimodal retrieval system to perform cross-modal retrieval.

[0109] Figure 5 is a block diagram illustrating an electronic device 500 according to an exemplary embodiment of the present disclosure.

[0110] Reference Figure 5 The electronic device 500 includes at least one memory 501 and at least one processor 502. The at least one memory 501 stores instructions. When the instructions are executed by the at least one processor 502, the backdoor attack method according to the exemplary embodiment of the present disclosure is executed.

[0111] As an example, electronic device 500 may be a PC, tablet device, personal digital assistant, smartphone, or other device capable of executing the aforementioned instructions. Here, electronic device 500 is not necessarily a single electronic device, but may also be any collection of devices or circuits capable of executing the aforementioned instructions (or instruction sets) individually or in combination. Electronic device 500 may also be part of an integrated control system or system manager, or may be configured as a portable electronic device that interfaces with local or remote devices (e.g., via wireless transmission).

[0112] In electronic device 500, processor 502 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller, or a microprocessor. By way of example and not limitation, the processor may also include an analog processor, a digital processor, a microprocessor, a multi-core processor, a processor array, a network processor, etc.

[0113] The processor 502 can execute instructions or codes stored in the memory 501, wherein the memory 501 can also store data. Instructions and data can also be sent and received over a network via a network interface device, wherein the network interface device can use any known transmission protocol.

[0114] The memory 501 may be integrated with the processor 502, for example, by placing RAM or flash memory within an integrated circuit microprocessor or the like. Furthermore, the memory 501 may comprise a separate device, such as an external disk drive, a storage array, or any other storage device usable by a database system. The memory 501 and the processor 502 may be operatively coupled or may communicate with each other, for example, via an I / O port, a network connection, or the like, such that the processor 502 can access files stored in the memory.

[0115] In addition, the electronic device 500 may further include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, a mouse, a touch input device, etc.) All components of the electronic device 500 may be connected to each other via a bus and / or a network.

[0116] According to an exemplary embodiment of the present disclosure, a computer-readable storage medium may also be provided, which, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the above-mentioned backdoor attack method. Examples of computer-readable storage media include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disk storage, hard disk drive (HDD), solid state drive (SSD), card storage (such as a multimedia card, secure digital (SD) card or extreme digital (XD) card), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk and any other device configured to store a computer program and any associated data, data files and data structures in a non-transitory manner and provide the computer program and any associated data, data files and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the above-mentioned computer-readable storage medium can be executed in an environment deployed in a computer device such as a client, a host, an agent device, a server, etc. In addition, in one example, the computer program and any associated data, data files and data structures are distributed on a networked computer system so that the computer program and any associated data, data files and data structures are stored, accessed and executed in a distributed manner by one or more processors or computers.

[0117] According to exemplary embodiments of the present disclosure, a computer program product may also be provided, including a computer program, wherein when the computer program is executed by a processor, the backdoor attack method according to the present disclosure is implemented.

[0118] According to the backdoor attack method, device, electronic device, storage medium and computer program product disclosed in the present invention, contaminated text, i.e., backdoor text, is obtained by performing style transfer on the original text. This can avoid the phenomenon of text fluency and semantic coherence being destroyed due to the insertion of obvious trigger words, and thus can effectively reduce the risk of being discovered by defense mechanisms and manual inspections, thereby improving the stealth and naturalness of backdoor attacks.

[0119] Furthermore, by introducing the degree of style deviation to screen candidate texts, it can ensure that the backdoor text, that is, the attack text and the original text are highly consistent in semantics and structure, further enhancing the stealth and stability of the backdoor attack.

[0120] Furthermore, the feature fusion mechanism proposed in this disclosure can manipulate the features of backdoor samples in a targeted manner, directing them toward a preset target category in an image-text retrieval system. This allows backdoor text to be incorrectly matched to images of the target category during multimodal retrieval, thereby enabling a covert and effective cross-modal attack. Furthermore, the backdoor attack method provided in this disclosure has no negative impact on normal input, meaning that this disclosure can achieve a high success rate of covert backdoor attacks while barely affecting the original functionality of the model.

[0121] According to an exemplary embodiment of the present disclosure, by setting a plurality of style prompt templates, sentences with a plurality of natural language style features can be generated correspondingly for the same original text, thereby enhancing the diversity and concealment of the backdoor text.

[0122] According to an exemplary embodiment of the present disclosure, by screening candidate texts through a dual constraint mechanism of structural entropy and semantic entropy, the hallucination content that may be generated by a large language model can be effectively filtered out, and the screened backdoor text can be ensured to be highly consistent with the original text, thereby enhancing the reliability and concealment of backdoor attacks.

[0123] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

[0124] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A backdoor attack method, characterized in that: include: Obtaining a text set, wherein the text set includes clean text and contaminated text, wherein the clean text is text that has not been subjected to style transfer, and the contaminated text is original text subjected to style transfer, to obtain multiple candidate texts, and calculating the degree of style deviation between the original text and the multiple candidate texts, and then screening and retaining candidate texts from the multiple candidate texts, wherein the smaller the degree of style deviation, the higher the probability that the corresponding candidate text will be retained; Inputting the text set into a backdoor discriminator to obtain a backdoor discriminant result for each text in the text set; When the backdoor discrimination result indicates that the corresponding text is the clean text, extracting clean semantic features of the text; When the backdoor discrimination result indicates that the corresponding text is the contaminated text, extracting the contaminated semantic features of the text, and performing a weighted summation of the contaminated semantic features and the preset target category features to obtain a fused semantic feature, wherein the preset target category features are used to characterize the characteristics of the target category object; The clean semantic features, the fused semantic features and the image samples are input into a multimodal retrieval system to perform cross-modal retrieval.

2. The backdoor attack method according to claim 1, wherein: The style deviation degree is the structural difference, which is calculated by the following formula: in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents a set of syntactic dependencies extracted from the original text, is the dth syntactic dependency among the multiple syntactic dependency relationships included in the syntactic dependency relationship set, represents the probability of the occurrence of the d-th syntactic dependency, represents the structural entropy of the original text, represents the structural entropy of the i-th candidate text, represents the structural difference between the original text and the i-th candidate text.

3. The backdoor attack method according to claim 1, wherein: The degree of style deviation is a semantic difference, which is calculated using the following formula: in, represents the original text, represents the i-th candidate text among the multiple candidate texts, represents the jth candidate text among the multiple candidate texts, represents the semantic embedding vector corresponding to the original text, represents the semantic embedding vector corresponding to the i-th candidate text, represents the semantic embedding vector corresponding to the j-th candidate text, Indicates the semantic difference between the original text and the i-th candidate text, i≠j.

4. The backdoor attack method according to claim 1, wherein: The preset target category feature is calculated using the following formula: in, is the preset target category feature, is a set of clean texts used to describe the target category objects, is the w-th clean text in the clean text set, represents the number of clean texts contained in the clean text set, Represents the semantic features of the w-th clean text.

5. The backdoor attack method according to claim 1, wherein: The style of the original text is transferred in the following way: Get the prompt words corresponding to the preset style; The prompt words corresponding to the preset style and the original text are input into a large language model to obtain a plurality of candidate texts of the original text in the preset style.

6. The backdoor attack method according to claim 5, characterized in that: The preset style includes at least one of the following items: Emphasis sentence style, appositive sentence style, existential sentence style, inversion sentence style, imperative sentence style, and exclamatory sentence style.

7. A backdoor attack device, characterized in that: include: a text acquisition module configured to acquire a text set, wherein the text set includes clean text and polluted text, wherein the clean text is text that has not undergone style transfer, and the polluted text is original text subjected to style transfer to obtain multiple candidate texts, and after calculating the degree of style deviation between the original text and the multiple candidate texts, screen and retain candidate texts from the multiple candidate texts, wherein the smaller the degree of style deviation, the higher the possibility that the corresponding candidate text will be retained; a backdoor discrimination module configured to input the text set into a backdoor discriminator and obtain a backdoor discrimination result for each text in the text set; a clean feature extraction module configured to extract clean semantic features of the text when the backdoor discrimination result indicates that the corresponding text is the clean text; a feature fusion module configured to, when the backdoor discrimination result indicates that the corresponding text is the contaminated text, extract the contamination semantic features of the text, and perform a weighted summation of the contamination semantic features with preset target category features to obtain a fused semantic feature, wherein the preset target category features are used to characterize the characteristics of the target category object; The retrieval module is configured to input the clean semantic features, the fused semantic features and the image sample into a multimodal retrieval system to perform cross-modal retrieval.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the backdoor attack method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the backdoor attack method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the backdoor attack method according to any one of claims 1 to 6 is implemented.

Images