Invisible backdoor attack method used in federal self-supervised learning system

Abstract

The invention provides an invisible backdoor attack method used in a federal self-supervised learning (FSSL) system. According to the method, the feature distribution of the backdoor sample and the feature distribution of the enhanced sample are decoupled, and the slice-Wasserstein distance is introduced to relieve the distribution external characteristics of the backdoor sample, so that the trigger generation process is optimized. Based on a plurality of FSSL scenes and data sets, experimental results prove that the method disclosed by the invention is remarkably superior to an existing backdoor attack method in the aspect of performance, and shows strong robustness under a plurality of defense mechanisms.

Description

Technical Field

[0001] This invention belongs to the field of backdoor attacks, specifically relating to a stealth backdoor attack scheme based on federated self-supervised learning with imperceptible perturbations. Background Technology

[0002] Self-supervised learning (SSL), a technique that learns data representations without manual annotation, has been widely used in the field of computer vision. Federated self-supervised learning (FSSL) combines the advantages of self-supervised learning and federated learning, enabling effective training using distributed data while protecting data privacy, and possesses good scalability and application prospects.

[0003] However, due to its decentralized structure, FSSL is vulnerable to backdoor attacks. Attackers can inject specific samples or perturbations locally, guiding the global model to produce abnormal outputs under triggered inputs. Existing backdoor attack methods mostly employ explicit triggering or direct transfer of strategies from supervised learning, which suffer from poor concealment, weak transferability, and severe entanglement with the distribution of augmented samples in FSSL, making effective attacks difficult. Furthermore, some imperceptible triggering methods exhibit obvious "out-of-distribution" characteristics in the feature space, making them easily detectable by defense mechanisms. Current research mainly focuses on visual backdoor methods, with insufficient research on invisible and imperceptible backdoor methods.

[0004] Therefore, there is an urgent need for a stealthy and undetectable backdoor attack method for FSSL. Summary of the Invention

[0005] Purpose of the invention: This invention aims to address the security vulnerabilities of FSSL systems when facing backdoor attacks, and proposes an invisible and undetectable backdoor attack method for FSSL to improve the understanding of model security and the reliability of model training.

[0006] Technical solution:

[0007] This invention proposes a stealth backdoor attack method for federated self-supervised learning systems, comprising:

[0008] Step 1: Generate imperceptible perturbations using a trained injector, and construct a set of backdoor samples including the imperceptible perturbations based on the original samples;

[0009] Step 2: Among the multiple initial client models corresponding to the server of a federated self-supervised learning system, select one initial client model for local training. During the local training process, the feature distribution decoupling mechanism is used to increase the distribution difference between the augmented samples used for local training and the backdoor samples in the feature space.

[0010] Step 3: Introduce slice-Wasserstein distance as a regularization term for the backdoor concealment of the federated self-supervised learning system;

[0011] Step 4: Using the double alignment loss function, the backdoor samples are aggregated in the embedding space to the attack target category samples of the initial client model trained locally, thus obtaining the client model with injected backdoor samples.

[0012] Step 5: Upload the client model with the injected backdoor sample to the server of the federated self-supervised learning system, and perform federated average aggregation with other initial client models. The backdoor sample is passed to the global model of the federated self-supervised learning system in the form of weights.

[0013] Furthermore, the imperceptible perturbation is a semantically oriented pixel perturbation, and the original sample is an image obtained from a public dataset.

[0014] Furthermore, the feature distribution decoupling mechanism maximizes the Euclidean distance between the backdoor sample and the enhanced sample in the HSV and HSL color spaces, achieved by maximizing the feature decoupling loss function; the feature decoupling loss function L dis for:

[0015]

[0016] in, To augment the samples, x is the input backdoor sample, D k Let c(x) represent the local data distribution on the k-th client model, and let c(x) represent the one-dimensional projection of the backdoor sample in a certain color channel, where the color channel includes H, S, V, and L.

[0017] Furthermore, the introduction of the slice-Wasserstein distance includes:

[0018] The feature representations of the backdoor sample and the original sample in the high-dimensional embedding space are projected onto several randomly selected one-dimensional directions respectively;

[0019] For each of the said one-dimensional directions s, calculate the backdoor sample distribution along that direction. L2 norm, original sample distribution The L2 norm;

[0020] Calculate the slice-Wasserstein distance W sliced The formula is:

[0021]

[0022] Where S is the sum of the one-dimensional directions s.

[0023] Furthermore, the dual alignment loss function L align It is the cosine similarity between the backdoor sample and the target category sample, expressed as:

[0024]

[0025] Where x′ is the backdoor sample, x t Let x represent the original sample, f(·,θ) represent the feature encoder, and θ represent the original model parameters. Here are the parameters for the backdoor model, and s(·,·) is the cosine similarity function.

[0026] Furthermore, the federal average aggregation process is expressed as follows:

[0027]

[0028] Where w (t+1) This represents the global model parameters after the (t+1)th round update. Both the initial client model and the client model of the injected backdoor sample are considered as client models. Let n represent the model weights generated by the k-th client model after the t-th round of local training. k This represents the number of data samples held by the k-th client, and n represents the total number of samples.

[0029] Furthermore, the model of the trained injector adopts a U-Net structure.

[0030] Furthermore, the client model is trained locally using a self-supervised learning algorithm, including SimCLR, MoCo, BYOL, and SwAV.

[0031] This invention also proposes a stealth backdoor attack system for federated self-supervised learning systems, comprising:

[0032] An attack generation module is used to generate imperceptible perturbations through a trained injector, and to construct a set of backdoor samples including the imperceptible perturbations based on the original samples.

[0033] The attack injection module is used to increase the distribution difference between the augmented samples used for local training and the backdoor samples in the feature space during the local training process of the client model of the federated self-supervised learning system by utilizing the feature distribution decoupling mechanism; it introduces the slice-Wasserstein distance as a regularization term for the concealment of the federated self-supervised learning system; and it uses a double alignment loss function to aggregate the backdoor samples into the attack target category samples of the client model in the embedding space to obtain the client model with injected backdoor samples.

[0034] The attack and penetration module is used to upload the client model to the server of the federated self-supervised learning system, where it is federated and averaged together with other client models. The backdoor samples are passed to the global model in the form of weights.

[0035] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the aforementioned methods.

[0036] Beneficial effects: The stealth backdoor attack method proposed in this invention has the following significant advantages compared with the prior art:

[0037] (1) By introducing a feature distribution decoupling mechanism, this invention can more accurately distinguish between changes caused by perturbation and natural fluctuations in the enhancement process, effectively alleviate the feature entanglement phenomenon, and provide a more independent and identifiable expression basis for backdoor attack semantics.

[0038] (2) The present invention introduces a concealment loss in the injector training stage, with the slice-Wasserstein distance as the core, to improve the backdoor's camouflage ability in the feature space and effectively avoid the capture of out-of-distribution samples by existing clustering class defense, anomaly detection and other methods.

[0039] (3) This invention constructs a loss target by the difference between backdoor samples and target category samples, effectively guiding the injected perturbation to transfer the semantics of the original sample from the original category to the target category. By comparing the embedding performance of the original path and the attack path, the semantics of the backdoor are accurately guided and effectively triggered, thereby maintaining the attack effect after global aggregation, and providing structural protection for the activation of backdoor behavior. Attached Figure Description

[0040] Figure 1 It is a backdoor injection process in federal self-supervised learning;

[0041] Figure 2 It represents the difference in residual representation between the original image and the image attacked by the backdoor under different backdoor methods;

[0042] Figure 3 These are experimental results of the method of this invention under different encoder architectures and SSL algorithms;

[0043] Figure 4 This is the GradCAM visualization result of the original model and the backdoor model. Detailed Implementation

[0044] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. The present invention proposes a method for stealthy backdoor attacks based on imperceptible perturbation-based federated self-supervised learning, comprising the following steps:

[0045] Step 1: Construct a backdoor perturbation mechanism generated by a trainable injector. The injector applies subtle but semantically targeted perturbations to the original image in an end-to-end manner, so that the generated backdoor sample has potential attack capabilities while maintaining the overall naturalness of the image.

[0046] This invention establishes that the attacker has complete control over the attacker's local training data, model parameters, and loss function. A trainable perturbation injector network is designed to apply subtle but directional perturbations to the original image, generating backdoor samples. This perturbation injector employs a U-Net structure and is updated during training by jointly optimizing multiple loss functions, ensuring that the output image maintains a high degree of similarity to the original image at the pixel level, but exhibits significant semantic deviations in the feature space. The injector obtains perturbation parameters through end-to-end training and can automatically learn how to embed camouflaged backdoor signals without relying on fixed templates or visible patterns, ensuring that the generated backdoor samples are highly effective at attacking the target image while remaining imperceptible to the human eye.

[0047] Step 2: During the local training phase, a feature distribution decoupling mechanism is introduced. By measuring the multi-channel differences between the backdoor sample and its enhanced version in the HSV and HSL color spaces and maximizing the Euclidean distance, the changes introduced by the perturbation and those caused by normal enhancement are effectively distinguished, thus alleviating the feature entanglement phenomenon.

[0048] To address the issue of high overlap between backdoor samples and their enhanced versions in the feature space, this invention designs and introduces a Feature Disentanglement Loss. This loss function aims to maximize the distance between the backdoor sample and its enhanced version in the semantic space, thereby enhancing the separability and stability of the backdoor semantics in the embedding space and improving attack robustness. The basic idea is to map the image from the traditional RGB color space to HSV and HSL color spaces. Multiple one-dimensional color channels (such as Hue, Saturation, and Value / Lightness) are extracted from these color spaces with higher perceptual consistency to measure the feature deviation caused by backdoor perturbations. Since common data augmentation operations (such as ColorJitter) primarily affect the color attributes of the image, directly measuring along these color channel dimensions allows for a more accurate distinction between changes caused by perturbations and natural fluctuations during the augmentation process.

[0049] In practical implementation, for any input sample x, its version after data augmentation during the pre-training phase is denoted as... Define a color channel mapping function c(·) to project the image onto specified channels (e.g., H, S, V, L). Then, calculate the squared Euclidean distances between the backdoor sample x and its enhanced version x~ on each color channel, and take their weighted average as the loss term. The entire feature decoupling loss function is defined as follows:

[0050]

[0051] Among them, D k Let represent the local data distribution on the k-th client, and let c(x) represent the one-dimensional projection of the input sample onto a certain color channel. This represents the squared l2 distance along the channel direction. By maximizing the above loss function, the training process encourages the model to better distinguish between backdoor perturbations and enhancement perturbations in the color feature space, thereby achieving distributional decoupling in the semantic space. This mechanism significantly alleviates the phenomenon of backdoor samples being "entangled with the enhanced representation of normal samples" in the feature space, providing a more independent and identifiable representational basis for backdoor attack semantics.

[0052] Step 3: Introduce the slice-Wasserstein distance as a regularization term to measure the distribution difference between the backdoor sample and the original sample in multiple one-dimensional projection subspaces. By averaging the distribution distances in multiple directions, minimize the overall deviation of the embedded features, significantly improve the "naturalness" and "distribution consistency" of the backdoor sample, thereby enhancing its concealment in the feature space.

[0053] To improve the naturalness and imperceptibility of backdoor samples in the feature space, this invention introduces a stealthiness loss during the injector training phase. This loss term, based on the sliced ​​Wasserstein distance, minimizes the offset between backdoor samples and normal samples in the embedded feature distribution, addressing the issue of backdoor samples appearing as "out-of-distribution" points in the feature space. Since directly calculating the traditional 2-Wasserstein distance in a high-dimensional feature space is difficult to optimize due to high computational cost and lack of stable closed-loop solutions, this invention uses the sliced-Wasserstein distance as an alternative. This method projects the high-dimensional embedding representation along multiple one-dimensional directions, calculates the one-dimensional Wasserstein distance in each direction, and finally averages the results across all directions to obtain a distribution similarity metric with numerical stability and high efficiency. The definition of the sliced-Wasserstein distance is as follows:

[0054]

[0055] Where ζ and τ represent the marginal probability distributions of the original sample and the backdoor sample in the embedding space, respectively; S represents the number of one-dimensional sampling directions, which is usually obtained by uniform sampling from a unit hypersphere. and Let represent the cumulative distribution functions (CDFs) of the backdoor sample and the original sample after one-dimensional projection in the s-th direction, respectively; the integral term reflects the difference in distribution between the two in this direction, and the sum of squares followed by the square root yields the overall distance estimate. To use this metric in the optimization process of backdoor perturbation injection, this invention defines the following concealment loss function:

[0056]

[0057] Where x~D k Let F(x) represent the local dataset from the k-th client, and let F(x) represent the high-dimensional embedding representation of the input sample x. This is a backdoor sample after being perturbed by the injector. Given its corresponding embedding representation, SWD represents the slice Wasserstein distance mentioned above. This loss function takes the embedding layer output as the input metric and minimizes the distribution deviation between the backdoor samples and the original samples, thereby improving the "disguise" ability of the backdoor in the feature space and effectively avoiding the capture of out-of-distribution samples by existing clustering class defense, anomaly detection and other methods.

[0058] Step 4: A dual feature alignment strategy is proposed. By constructing a loss function with consistent embedding semantics, backdoor samples are guided to aggregate towards the attack target category in the feature space, thereby further improving the accuracy and stability of backdoor activation.

[0059] The Dual Alignment Loss function ensures that the injected perturbation backdoor samples can stably aggregate in the feature space to the vicinity of the attack target class, forming a distinguishable feature boundary with the original samples. Since federated self-supervised learning models typically do not directly rely on explicit labels for training, their feature representations are highly dependent on the structure of the input samples themselves. Therefore, the semantic shift caused by the backdoor perturbation must be transmitted through feature embedding aggregation. To this end, this invention introduces a dual embedding alignment mechanism in the client that includes the backdoor samples, ensuring that the backdoor samples generated by the injector are semantically consistent with the target class in the embedding space.

[0060] Specifically, this mechanism uses cosine similarity as a metric to compare the feature alignment between backdoor samples and attack target class samples in the embedding space, while simultaneously comparing the alignment between the original samples and the target samples, thus forming a difference constraint. The goal of the loss function is to maximize the semantic similarity between the backdoor samples and the target samples, while minimizing the semantic similarity between the original samples and the target samples, to highlight the semantic shift effect caused by the backdoor perturbation. The form of the loss function is as follows:

[0061]

[0062] Where D k Let x represent the local dataset of the k-th client; x represents the original sample. Indicates via injector Processed backdoor sample, x t For samples of the attack target category; f(·,θ) and represents the feature encoders for the original model and the model including the backdoor sample, respectively, and the output is the representation of the sample in the embedding space; s(·,·) is the cosine similarity function.

[0063] The first term in the loss function The second term s(f(x,θ),f(x) represents the similarity between the backdoor sample and the target category sample in the model embedding space including the backdoor sample, and the optimization direction is to maximize it; t θ) represents the similarity between the original sample and the target class sample in the original model embedding space, and the optimization direction is to minimize it. The loss objective is constructed using the difference between the two, which can effectively guide the injected perturbation to transfer the semantics of the original sample from the original class to the target class. This dual alignment mechanism, by comparing the embedding performance of the original path and the attack path, accurately guides and effectively triggers the backdoor semantics, thereby maintaining the attack effect after global aggregation and providing structural protection for the activation of backdoor behavior.

[0064] Step 5: During federated training, backdoor samples are injected into the model for aggregation. A schematic diagram of this process is shown below. Figure 1 As shown.

[0065] The entire attack process described in steps 1-4 is embedded into a standard federated self-supervised learning framework. When an attack client is selected to participate in training, it trains a backdoor model locally through the above mechanism and uploads it to the server. After the backdoor model is federated and averaged together with other client models, the backdoor behavior (the backdoor sample mentioned above, i.e., the poisoned dataset) is implicitly injected into the global model and can be triggered in subsequent downstream tasks, thereby achieving control over the model behavior.

[0066] In the FSSL scenario, the backdoor injection process in this invention achieves synchronous updates of the global model and gradual diffusion of backdoor semantics through the standard FedAvg mechanism. In each round of federated training, some clients participate in backdoor injection as attackers. Their local models receive weight parameters based on the global initial model and apply imperceptible backdoor perturbations to the original samples using a perturbation injector. Subsequently, through the feature decoupling loss, concealment regularization term, and semantic aggregation mechanism proposed in this invention, the backdoor samples are guided to aggregate into the feature center of the target category in the embedding space, and a local model carrying backdoor behavior is trained.

[0067] After all clients (including normal clients and attack clients, including those containing the backdoor sample of this invention) have completed local training, their model weights are then... The data is uploaded to the server, where it performs standard federated average aggregation to update the global model. The mathematical expression of this aggregation process is as follows:

[0068]

[0069] Where w (t+1) This represents the global model parameters after the (t+1)th round update. Let n represent the model weights generated by the k-th client after the t-th round of local training. k This represents the number of data samples held by the k-th client. The total number of samples is:

[0070]

[0071] The model weights uploaded by the attacking client, including backdoor samples, implicitly contain backdoor perturbation semantics. The FedAvg aggregation process does not recognize or filter this semantics, causing these parameters carrying backdoor features to be mixed into the global model. As the number of training rounds increases, the perturbation semantics of the attack model continuously infiltrate the global parameter distribution and gradually explicitly express backdoor behavior. After training is complete, the final global model will exhibit a specific biased output when faced with backdoor trigger inputs, thus achieving the attack target; while maintaining normal performance on ordinary original samples, achieving high stealth and stable triggering of the backdoor.

[0072] This aggregation mechanism does not rely on any changes to the model structure or the federation protocol, and has strong versatility. It is compatible with multiple FSSL frameworks and can circumvent common federation defense strategies, providing technical assurance for the stable deployment of attack effects in real systems.

[0073] Next, from multiple perspectives such as concealment, actual attack effect, versatility, and anti-detection capability, experimental data will be used to demonstrate the performance of the stealth backdoor attack method of this invention.

[0074] Experiment 1:

[0075] To verify the high degree of concealment of the method at the image vision level, several typical backdoor attack methods (including Patch triggers, Instagram filter triggers (Ins-xpro2, Ins-brannan), WaNet geometric perturbations, IBA perturbations, CTRL coding perturbations, etc.) were used as baselines. Backdoor samples with the same original images as the method of this invention were generated, and the residual maps between them and the original images were calculated for comparative analysis. All methods were tested uniformly under BADFSS settings, and their attack success rate (ASR) was recorded to reflect the effectiveness of the attack. Figure 2 As shown, the first row displays the original image and the backdoor images generated by each method, while the second row displays the residual images between each backdoor image and the original image. The comparison results show that traditional explicit perturbation methods (such as Patch and CTRL) introduce significant pixel anomalies at the visual level, which are easily detected by the human eye or image processing algorithms; while filter-type perturbations (such as Ins-xpro2 and Ins-brannan) exhibit obvious color shifts. Although geometric transformation methods (such as WaNet and IBA) introduce more subtle perturbations, strong edge contour structures can still be observed in the residual images.

[0076] In contrast, the backdoor sample generated by the method of this invention (Ours) is visually highly consistent with the original image, and the residual map has almost no obvious structure, showing only slight local changes, indicating that the perturbation injected by this invention is highly imperceptible. Meanwhile, the method of this invention still maintains an attack success rate of 99.94% in this attack scenario, far exceeding other methods, demonstrating a performance advantage that combines high attack power and high stealth. The experimental results verify the significant effect of the feature space stealth constraint mechanism designed in this invention at the image level, further confirming its practicality in evading detection in real-world applications.

[0077] Experiment 2:

[0078] To systematically evaluate the actual attack performance of the imperceptible perturbation backdoor attack method proposed in this invention within the Federated Self-Supervised Learning (FSSL) framework, comparative experiments were conducted on multiple mainstream datasets to comprehensively measure its attack success rate (ASR) and backdoor retention capability (BA). Five common image classification datasets were used in the experiments: CIFAR-10, STL-10, GTSRB, SVHN, and Tiny-ImageNet. These datasets cover diverse visual scenes, including natural images, traffic signs, street view digits, and medium-sized multi-class images, effectively simulating the federated learning distribution of multi-source heterogeneous clients in real-world environments. The experiments followed standard federated self-supervised learning settings, i.e., the pre-training dataset and the downstream task dataset were not identical, to realistically recreate cross-task transfer learning scenarios. Different datasets were used as pre-training sources, and the attack performance was verified using multiple downstream datasets. The methods of this invention were systematically compared with four current representative backdoor attack methods (including WaNet and IBA based on explicit perturbations, and CTRL and BADFSS based on self-supervised mechanisms), uniformly measuring the attack performance of each method under different tasks.

[0079] As shown in Table 1, the method of this invention achieves significantly better performance than existing methods across multiple task settings. For example, in a data combination using STL-10 as the pre-training dataset and CIFAR-10 as the downstream task, the method of this invention achieves an attack success rate (ASR) of up to 99.94% and a backdoor retention capability (BA) of 87.19%, far exceeding other attack methods. In contrast, traditional supervised methods (such as WaNet and IBA) can only achieve 11.48% and 27.07% ASR, respectively, and their BA is also significantly lower than that of the method of this invention, verifying their insufficient applicability in FSSL. Furthermore, compared to the self-supervised methods CTRL and BADFSS, the method of this invention can maintain both high ASR and high BA in all pre-training-downstream combinations, achieving a balance between adversarial capability and robustness. Furthermore, even with the more challenging Tiny-ImageNet as the pre-training source, the method of this invention maintains its leading position on all downstream datasets, achieving an ASR of 96.91% on the GTSRB task and 95.25% on the SVHN task, while maintaining a BA metric above 71%. These results demonstrate that the method of this invention not only possesses strong generalization ability but also adapts to high-dimensional and complex model scenarios.

[0080] Table 1 Comparison of attack performance on different datasets

[0081]

[0082] Experiment 3:

[0083] To verify the stealth performance of the method of this invention at the visual level, that is, the backdoor perturbation can still effectively trigger the attack without causing significant perceptible changes in the image, three common image quality assessment metrics, including structural similarity (SSIM), peak signal-to-noise ratio (PSNR), and perceptual distance (LPIPS), were used to quantitatively analyze the generated backdoor samples, aiming to comprehensively evaluate the perceptibility of the image perturbation. The results are shown in Table 2.

[0084] Table 2. Stealth assessment on different datasets

[0085]

[0086]

[0087] In the experiments, CIFAR-10, STL-10, and Tiny-ImageNet were used as pre-training datasets, and comparative experiments were conducted using three typical downstream datasets: STL-10, GTSRB, and SVHN. The evaluation results are shown in Table 2. In all data combinations, the backdoor samples generated by the method of this invention exhibited extremely high SSIM values ​​(most exceeding 0.98), indicating that the method causes minimal interference to the image structure, and the generated samples maintain a high degree of consistency with the original image at the spatial structure level. Simultaneously, the PSNR values ​​were generally at a high level, reaching a maximum of 36.88, indicating that the injected perturbation has an extremely weak impact on pixel intensity, causing almost no visible noise. Furthermore, the LPIPS value, as an indicator of perceptual difference, remained entirely within an extremely low range (0.0012 to 0.0311), confirming the minimal visual difference between the backdoor samples and the original image from a perceptual perspective.

[0088] Experiment 4:

[0089] To verify the applicability and universality of the imperceptible perturbation backdoor attack method proposed in this invention under different federated self-supervised learning frameworks, experiments were conducted from two aspects: different self-supervised learning algorithms and different encoder structures. The results are as follows: Figure 3 As shown.

[0090] First, regarding self-supervised learning algorithms, four representative methods—SimCLR, MoCo, BYOL, and SwAV—were selected as pre-training frameworks for the local client. While maintaining consistent attack configurations, the attack success rate (ASR) and backdoor sample classification accuracy (ACC) of this invention were evaluated under these four algorithms. Experimental results show that this invention exhibits stable and high attack capabilities (ASR close to or exceeding 95%) across the different SSL algorithms, and maintains a high level of accuracy in identifying normal samples (ACC exceeding 78%), indicating that the attack method has good algorithmic adaptability and generalization ability.

[0091] Secondly, to verify the adaptability of this method to different encoder architectures, using the STL-10 dataset as the training basis, ResNet-18, ResNet-50, and Vision Transformer (ViT) were selected as client model architectures to evaluate the backdoor injection effect of the method. Under different architectures, the attack success rate of this invention is still close to 100%, and it maintains a high backdoor sample recognition ability, further demonstrating that the method has good structural generalization ability and is suitable for various mainstream visual encoder designs.

[0092] Experiment 5:

[0093] To further verify the anti-detection capability of the proposed stealth backdoor attack method against existing mainstream defense mechanisms, two representative detection methods, Neural Cleanse and DECREE, are introduced for comparative analysis. Neural Cleanse is a detection method based on inverted trigger reconstruction, which determines whether a model is contaminated by a backdoor by calculating the deviation between the reconstructed trigger and a normal sample. Its specific criterion is: if the anomaly index of a model after being attacked exceeds a threshold of 2, it is considered a backdoor model. Since Neural Cleanse was originally designed for classifiers and is difficult to directly apply to the detection of unsupervised feature encoders, it is used to detect whether a downstream classifier in federated self-supervised learning has a backdoor embedded.

[0094] As shown in Table 3, the backdoor samples generated by the method of this invention consistently maintain a low anomaly index in Neural Cleanse detection under different combinations of pre-training and downstream datasets. For example, in the configuration of using CIFAR-10 as pre-training and STL-10 as the downstream dataset, the anomaly index is 1.11; while in the configuration of STL-10 pre-training and SVHN downstream, the value is 1.37, both significantly lower than the threshold of 2, indicating successful circumvention of the detection mechanism. On the other hand, DECREE evaluates whether the pre-trained encoder is contaminated by a backdoor by inverting the trigger and calculating its orthogonal projection norm in the feature space. If the norm value is lower than 0.1, the model is considered to be attacked. According to the results in Table 3, the values ​​corresponding to the backdoor samples generated by the method of this invention are higher than the detection threshold in all experimental configurations. For example, in the combination of CIFAR-10 and SVHN datasets, the value is 0.19; in the combination of STL-10 and GTSRB, the value is 0.31, both indicating that they are not identified as contaminated models by DECREE.

[0095] Table 3 Defense Assessment Results

[0096]

[0097] Experiment 6:

[0098] To further verify the interpretability and defense capability of the proposed imperceptible perturbation backdoor attack method, GradCAM visualization technology was introduced for heatmap analysis. GradCAM is a commonly used visualization tool that highlights the contribution of each pixel to the model's prediction results by emphasizing the model's regions of interest. It is often used to detect the presence of anomalous activation regions in the model, thereby identifying backdoor attacks. In this experiment, we performed GradCAM heatmap visualization on both the unattacked original model and the backdoor model attacked by the method of this invention. Figure 4 The results show the visualizations obtained on different image samples. The left side is the original image, and the right side is the corresponding GradCAM heatmap. The results show that the heatmaps of the original model and the backdoor model are almost identical on multiple image samples, with no significant abnormal activation regions. This indicates that the backdoor injection strategy proposed in this invention does not significantly perturb the salient regions of the model, thus effectively circumventing detection mechanisms based on visualization features, such as GradCAM.

Claims

1. A method for stealth backdoor attacks in federated self-supervised learning systems, characterized in that, include: Step 1: Generate imperceptible perturbations using a trained injector, and construct a set of backdoor samples including the imperceptible perturbations based on the original samples; Step 2: Among the multiple initial client models corresponding to the server of a federated self-supervised learning system, select one initial client model for local training. During the local training process, the feature distribution decoupling mechanism is used to increase the distribution difference between the augmented samples used for local training and the backdoor samples in the feature space. Step 3: Introduce slice-Wasserstein distance as a regularization term for the backdoor concealment of the federated self-supervised learning system; Step 4: Using the double alignment loss function, the backdoor samples are aggregated in the embedding space to the attack target category samples of the initial client model trained locally, thus obtaining the client model with injected backdoor samples. Step 5: Upload the client model with the injected backdoor sample to the server of the federated self-supervised learning system, and perform federated average aggregation with other initial client models. The backdoor sample is passed to the global model of the federated self-supervised learning system in the form of weights.

2. The stealth backdoor attack method according to claim 1, characterized in that, The imperceptible perturbation is a semantically oriented pixel perturbation, and the original sample is an image obtained from a public dataset.

3. The stealth backdoor attack method according to claim 2, characterized in that, The feature distribution decoupling mechanism maximizes the Euclidean distance between the backdoor sample and the enhanced sample in the HSV and HSL color spaces, achieved by maximizing the feature decoupling loss function; the feature decoupling loss function L... dis for: in, To augment the samples, x is the input backdoor sample, D k Let c(x) represent the local data distribution on the k-th client model, and let c(x) represent the one-dimensional projection of the backdoor sample in a certain color channel, where the color channel includes H, S, V, and L.

4. The stealth backdoor attack method according to claim 3, characterized in that, The introduced slice-Wasserstein distance includes: The feature representations of the backdoor sample and the original sample in the high-dimensional embedding space are projected onto several randomly selected one-dimensional directions s, respectively. For each of the said one-dimensional directions s, calculate the backdoor sample distribution along that direction. L2 norm, original sample distribution The L2 norm; Calculate the slice-Wasserstein distance W sliced The formula is: Where ζ represents the edge probability distribution of the original sample in the embedding space, τ represents the edge probability distribution of the backdoor sample in the embedding space, and S is the sum of the one-dimensional directions s.

5. The stealth backdoor attack method according to claim 4, characterized in that, The double alignment loss function L align It is the cosine similarity between the backdoor sample and the target category sample, expressed as: Where x′ is the backdoor sample, x t Let x represent the original sample, f(·,θ) represent the feature encoder, and θ represent the original model parameters. Here are the parameters for the backdoor model, and s(·,·) is the cosine similarity function.

6. The stealth backdoor attack method according to claim 5, characterized in that, The federal average aggregation process is represented as follows: Where w (t+1) This represents the global model parameters after the (t+1)th round update. Both the initial client model and the client model of the injected backdoor sample are considered as client models. Let n represent the model weights generated by the k-th client model after the t-th round of local training. k This represents the number of data samples held by the k-th client, and n represents the total number of samples.

7. The stealth backdoor attack method according to claim 6, characterized in that, The trained injector model uses a U-Net architecture.

8. The stealth backdoor attack method according to claim 7, characterized in that, The client model is trained locally using a self-supervised learning algorithm, including SimCLR, MoCo, BYOL, and SwAV.

9. A stealth backdoor attack system for federated self-supervised learning systems, characterized in that, include: An attack generation module is used to generate imperceptible perturbations through a trained injector, and to construct a set of backdoor samples including the imperceptible perturbations based on the original samples. The attack injection module is used to increase the distribution difference between the augmented samples used for local training and the backdoor samples in the feature space during the local training process of the client model of the federated self-supervised learning system by utilizing the feature distribution decoupling mechanism; it introduces the slice-Wasserstein distance as a regularization term for the backdoor concealment of the federated self-supervised learning system; and it uses a double alignment loss function to aggregate the backdoor samples into the attack target category samples of the client model in the embedding space to obtain the client model with injected backdoor samples. The attack and penetration module is used to upload the client model to the server of the federated self-supervised learning system, where it is federated and averaged together with other client models. The backdoor samples are passed to the global model in the form of weights.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of any of the methods described in claims 1 to 8.

Images