Poisoning defense method based on characteristic difference analysis and model layer purification

Abstract

The invention discloses a poisoning defense method based on characteristic difference analysis and model layer purification. The method comprises the following steps: S1, constructing a poisoning classification model according to an electromagnetic signal sample; adversarial disturbance is introduced, cross entropy loss of disturbed samples is calculated and sorted, and a threshold value is set to distinguish clean samples from poisoned samples; s2, after the poisoning samples are separated out, the poisoning score of each layer of the model is calculated through quantification, and the higher the score is, the stronger the influence of the back door neurons of the layer on the poisoning samples is; s3, generating a pseudo-poisoning sample based on an inversion trigger, analyzing the feature distribution difference between the pseudo-poisoning sample and a clean sample, aligning a feature space and purifying a model layer by optimizing an objective function, and enhancing the distinguishing ability of the model to the sample; s4, repeating the step S3 until the model classification precision converges, and storing the optimal network parameters; and the classification precision of the model on a normal sample and the attack success rate on a poisoning sample before and after defense are evaluated. According to the method, the robustness and the safety of the model are improved, and the method has relatively high universality.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of electromagnetic signal recognition and artificial intelligence, and involves electromagnetic signal processing and deep learning models. Specifically, it relates to a method that utilizes the differences in the distribution of electromagnetic signals in the feature space of each layer of the model to improve the robustness of the signal classification model, reduce the influence of triggers on the model, and improve the stability and reliability of the model in real complex electromagnetic environments. Background Technology

[0002] In recent years, the rapid development of artificial intelligence technology has enabled deep neural networks (DNNs) to demonstrate outstanding performance in many fields, including image recognition, object detection, speech recognition and signal processing. In particular, the powerful capabilities of deep learning have attracted the attention of many researchers in the field of radio signal modulation classification. (Reference [1]: X.Zha, X.Qin, Y.Zhou, and H.Peng, “Power of deep learning for amplitude-phase signal modulation recognition,” in 2019 IEEE 8 th Joint International Information Technology and Artificial Intelligence Conference (ITAIC). IEEE, 2019, pp.454–458.)

[0003] The widespread application of deep learning has brought about security risks from poisoning attacks, especially the threat of backdoor attacks. In order to address this challenge, researchers have proposed a variety of poisoning defense techniques in recent years, aiming to ensure the security and robustness of the model. Researchers believe that the poisoning-related neurons in normal samples are in a dormant state during the testing process. Based on this conjecture, they prune the poisoning-related neurons to remove the hidden poisoning in the DNN (Reference [2]: Liu K, Dolan-Gavitt B, Garg S. Fine-pruning: Defending against backdooringattacks on deep neural networks [C] / / Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21. Springer International Publishing, 2018: 273-294.). Some researchers used GradCAM to identify the regions affected by the triggers and remove these regions. Then, they used a GAN-based repair method to reconstruct the removed regions and eliminate the influence of the triggers on clean samples (Reference [3]: Doan BG, Abbasnejad E, Ranasinghe D C. Februus: Input purification defense against trojan attacks on deep neural network systems [C] / / Annual Computer Security Applications Conference. 2020: 897-912.). At the same time, some researchers studied the synthesis of backdoor triggers to suppress their influence. They generated inverse triggers with similar functions to the triggers and then enhanced the robustness of the model through model pruning and training strategies (Reference [4]: ​​Wang B, Yao Y, Shan S, et al. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks [C] / / 2019IEEE Symposium on Security and Privacy (SP). IEEE, 2019: 707 723.).Recently, a study proposed using knowledge distillation to reconstruct the poisoning model, suggesting that the distillation process can perturb the weights of the backdoor-related model, thereby eliminating the influence of the trigger pattern (Reference [5]:

[26] . Li Y, Lyu X, Koren N, et al. Neural attention distillation: Erasing backdoor triggers from deep neural networks [J]. arXiv preprint arXiv:2101.05930,2021.).

[0004] Therefore, to improve the robustness of deep learning models against poisoning attacks and effectively reduce the impact of triggers on model performance, this project proposes a poisoning defense method based on feature difference analysis and model layer purification. This method fully utilizes the insensitivity of triggers to perturbations and combines it with the distribution characteristics of the model in the feature space. While ensuring signal recognition accuracy, it significantly reduces the success rate of poisoning attacks and effectively improves the model's defense performance. Summary of the Invention

[0005] To overcome the shortcomings of existing deep learning-based electromagnetic signal poisoning defense research, which rarely fully utilizes signal features and model hierarchical analysis, and to improve the robustness of deep learning models against poisoning attacks and effectively reduce the impact of triggers on model performance, this invention proposes a poisoning defense method based on feature difference analysis and model layer purification. This method fully utilizes the insensitivity of triggers to disturbances and combines the model's distribution characteristics in the feature space. By extracting the feature representations of key layers, the poisoned model is purified. Specifically, the electromagnetic signal is first preprocessed to separate clean samples from poisoned samples. Poisoning scores are calculated for the deep learning model layers using the poisoned samples, and key layers are labeled. By analyzing the feature representations of these key layers and introducing a feature difference metric into the optimization objective function, not only can poisoned signals be effectively identified, but the model's discriminative ability and generalization performance are also enhanced. This invention not only significantly improves the model's individual identification accuracy but also greatly enhances the model's defense performance against poisoning attacks, providing a new solution for the security of deep learning models in the field of electromagnetic signal processing.

[0006] The technical solution adopted by this invention to solve its technical problem is as follows:

[0007] A poisoning defense method based on feature difference analysis and model layer purification includes the following steps:

[0008] S1: Construct a classification model based on electromagnetic signal samples, and perform poisoning training on the signal classification model, saving the trained poisoning classification model; acquire signal samples with poisoning risk, introduce adversarial perturbations into these samples, and through the perturbation mechanism, clean samples will be misclassified due to the interference of the perturbation, while poisoned samples will still be classified into the target category due to the presence of a preset trigger; then calculate the cross-entropy loss function value of the poisoned samples after adding perturbation, sort the loss values, and set a threshold to achieve the separation of clean samples and poisoned samples;

[0009] S2: After the poisoned sample is isolated, the poisoning score of each layer of the model can be further quantitatively calculated to evaluate the sensitivity of each layer to the poisoned sample and its degree of contamination. The calculation of the poisoning score is intended to characterize the dependence of each layer of the model on the poisoned sample. The higher the score, the stronger the dependence of the layer on the poisoned sample, thereby determining the effect of the backdoor neurons contained in the layer on the poisoned sample.

[0010] S3: The restored trigger is inverted using a trigger and added to clean samples to generate pseudo-poisoned samples. Key layer feature representations are extracted to obtain the distribution differences between clean and pseudo-poisoned samples in the feature space. An optimization objective function is designed to align the feature distribution and purify the model layers. By optimizing the feature space structure, the model's ability to distinguish clean samples is enhanced, while the impact of poisoned samples on the model is reduced. Labeled clean signal samples are input into the classification model, and cross-entropy loss is used for training to fine-tune the parameters of the overall classification model.

[0011] S4: Repeat S3. Once the accuracy of the classification model stabilizes, stop training and save the network parameters of the classification model at this point. Test the classification accuracy of the classification model for normal samples before and after defense, as well as the attack success rate for poisoned samples.

[0012] Furthermore, the process of step S1 is as follows:

[0013] First, a training set consisting of modulated signals is constructed. Where x i Let y represent the i-th signal sample. i This represents the label corresponding to the training sample, k is the total number of categories, t is a specific category, and N is the number of categories. tr Let x be the total number of samples, and x be the number of each signal sample. i These are all IQ vectors, obtained from discrete complex signals after preprocessing, as shown below:

[0014] x i =I i +jQ i (1)

[0015] Wherein, the real part is defined as I i The imaginary part is defined as Q. i Combine them to form a two-dimensional real-valued vector;

[0016] Define the trigger as Δ, the target class as t, and inject the trigger into the training set at a rate of γ∈(0,1) to generate a poisoned sample set, i.e.:

[0017]

[0018] N P =γ·N tr (3)

[0019] in, This indicates that the generated poisoned samples have their labels changed to the target category t of the attack, thus obtaining the poisoned sample set. N P This represents the number of poisoned samples in the training set. The poisoned samples and the remaining clean samples are then merged into a mixed training set D. mix ,Right now:

[0020] D mix =D P ∪ D C (4)

[0021] Among them, D C This is the remaining clean sample set;

[0022] Based on the hybrid training set D mix By minimizing the cross-entropy loss function

[0023] Training the poisoning model f θ,L (·), the optimization objective is:

[0024]

[0025] The specific form of the cross-entropy loss function is:

[0026]

[0027] in, The cross-entropy loss is used, where N represents the total number of classes contained in the training samples; y ij p represents the true label of whether the i-th sample belongs to the j-th class (with a value of 0 or 1); j (x i ) indicates that the model will x i The probability of predicting the class j is obtained through training. θ,L (·), where θ represents the model parameters of the poisoning model, and L is the number of layers in the model.

[0028] Preferably, step S1 further includes the following process:

[0029] Adversarial perturbations are added to the samples using the Projected Gradient Descent (PGD) method. This method is implemented through multiple iterations, with each iteration applying only a small perturbation to the samples and ensuring that the perturbation after each iteration is constrained within a preset norm constraint. The process is as follows:

[0030]

[0031] in, Let x represent the sample after M iterations, where T is the total number of iterations. When M = 0, the initial sample is x. i y i This indicates the corresponding label. The cross-entropy loss function is applied to the input. The gradient of the input vector is given by , where sign(·) is the sign function, and its output is the sign (±1) of each dimension component of the input vector, used to ensure that the perturbation direction is consistent with the gradient direction; α represents the step size, controlling the perturbation amplitude in the gradient direction, and ∈ represents the maximum perturbation magnitude. The adversarial example after iteration is denoted as .

[0032] More preferably, in step S1, since the trigger Δ still maintains its activation characteristics on the signal after the disturbance, the poisoned sample will still be classified into the target category after the disturbance, while the clean sample will be misclassified after being disturbed. By calculating the loss function value of the poisoned sample after the disturbance and sorting these loss values, the clean sample and the poisoned sample are distinguished. The sample with the higher loss value is identified as the clean sample, while the sample with the lower loss value is identified as the poisoned sample.

[0033]

[0034] Among them, S clean and S poisoned This represents the selected clean sample set and the poisoned sample set. P is expressed as the cross-entropy loss of the samples. η (L) represents the clean loss threshold; samples with a loss value higher than this threshold are considered clean samples; P β (L) represents the poisoning loss threshold. Samples with a loss value lower than this threshold are classified as poisoned samples.

[0035] Furthermore, the process of step S2 is as follows:

[0036] After screening, the poisoned sample set S was obtained. poisonedSubsequently, to quantify the degree of influence of poisoned samples on each layer of the model, a Layer Poisoning Score (LPS) was defined. The LPS reflects the gradient difference and rank change of a particular layer when processing poisoned and clean samples. Based on the LPS, the number N of layers with a significant poisoning impact was further determined. p This refers to the layer that requires intensive purification.

[0037]

[0038] Among them, LPS l The poisoning score is the value of the layer l ∈ (1,2,...,L). The gradient matrix of the poisoned sample at layer l is f. l For the feature output of the sample at layer l, Rank(f) l Let be the rank of the feature matrix of the l-th layer. A weighted sum is taken of the rank of the feature matrix and the L1 norm of the gradient matrix, with coefficients α and β respectively. The layer poisoning score is then obtained, and the layer requiring purification is selected based on this score, as shown in the following formula:

[0039]

[0040] Wherein, λ% is a preset threshold ratio, reflecting the proportion of high-level features that need to be purified. λ％ (·) indicates that the top λ% of the highest-scoring layers are taken, denoted as L. critical And mark it as a key layer.

[0041] Furthermore, the process of step S3 is as follows:

[0042] For the poisoned model, any input containing a trigger will be predicted as the target label, indicating that neurons activated by the trigger dominate the feature space. Therefore, the activation of poisoned samples shows a significant difference compared to clean samples. Thus, during defense, by extracting feature values ​​from key layers of the model, the distributions of clean and poisoned samples in the feature space are obtained. By comparing and analyzing the differences in their distributions, the degree of shift of poisoned samples in the feature space can be quantified. To obtain the poisoned samples corresponding to the clean samples, the target category is first extracted from the separated poisoned samples. Then, triggers are inverted based on the clean samples to restore the triggers required to generate the poisoned samples, and these triggers are added to the clean samples to form pseudo-poisoned samples. The separated clean sample set S is then used... clean To invert a trigger, the process is as follows:

[0043]

[0044] Wherein, the initial sample is (x i ,y i)∈S clean m k The binary mask for the k-th iteration is used to determine the trigger position, Δ. k Let x represent the trigger for the k-th iteration. i k+1 The pseudo-poisoned sample is generated after the k-th iteration. Let be the cross-loss entropy, γ be a hyperparameter controlling the regularization weights, and ||·||1 be the L1 norm used to achieve mask sparsity. Δ * and m * These are the trigger and mask after the iteration is complete;

[0045] Design a feature loss function to minimize the distribution difference between clean samples and pseudo-poisoned samples in the feature space, thereby achieving feature space purification of poisoned samples. The designed feature loss is:

[0046]

[0047] in, k∈L critical This represents the feature output of the sample at the key layer, where the input sample (x) is the key layer. i ,y i )∈S clean ;

[0048] While optimizing the feature space structure, it is necessary to ensure that the model's classification performance on clean samples is not compromised. To this end, cross-entropy loss is introduced as a classification loss to maintain the model's original classification ability on clean samples. By jointly optimizing the feature loss and cross-entropy loss, the model's high classification accuracy on clean samples can be maintained while purifying the feature space, and the parameters of the overall classification model can be fine-tuned.

[0049] Furthermore, in step S4, S3 is repeated to continuously purify the poisoned model, eliminate the influence of backdoor neurons, and ensure the model's ability to classify clean samples. Once the accuracy of the classification model is stable, training is stopped, and the network parameters of the classification model at this time are saved.

[0050] Preferably, in step S4, to test the classification accuracy of the classification model for clean samples and the attack success rate for poisoned samples containing triggers, firstly, the classification model structures before and after defense are loaded respectively, and the test clean sample set is then used. With poisoning sample set Input the data into each classification model separately, and calculate the classification accuracy (ACC) for clean samples and the attack success rate (ASR) for poisoned samples before and after defense, respectively. The formulas are as follows:

[0051]

[0052] Where f(·) represents the classification model to be tested after purification. This represents a clean test sample. N represents the poisoning test sample. test This represents the total number of samples contained in the test set. This indicates whether the model's predicted label is equal to the actual label.

[0053] The working principle of this invention is to identify and eliminate the impact of poisoned samples on deep learning models by adversarial perturbations and feature distribution differences. Furthermore, by designing and optimizing the objective function, it minimizes the intra-class distance of clean samples while maximizing the inter-class distance between poisoned and clean samples, thereby achieving alignment of feature distributions and purification of model layers.

[0054] The beneficial effects of this invention are: it can effectively distinguish between poisoned samples and clean samples, accurately quantify the degree of poisoning in each layer of the model, and achieve model purification through feature distribution alignment, thereby improving the robustness and safety of the model. At the same time, it has high versatility and can be applied to a variety of deep learning models and task scenarios. Attached Figure Description

[0055] Figure 1 This is a flowchart of the poisoning defense method based on feature difference analysis and model layer purification proposed in this invention.

[0056] Figure 2 This is a flowchart of the poisoning defense method based on feature difference analysis and model layer purification proposed in this invention. Detailed Implementation

[0057] The method of this invention will be described in further detail below with reference to the accompanying drawings and using a typical signal classification dataset as an example.

[0058] Reference Figure 1 and Figure 2 A poisoning defense method based on feature difference analysis and model layer purification includes the following steps:

[0059] S1: Construct a classification model based on electromagnetic signal samples, and perform poisoning training on the signal classification model, saving the trained poisoning classification model; acquire signal samples at risk of poisoning, and introduce adversarial perturbations into these samples. Through the perturbation mechanism, clean samples will be misclassified due to the interference of the perturbation, while poisoned samples will still be classified into the target category due to the presence of preset triggers. Then, by calculating the loss function value of the poisoned samples after adding perturbations and sorting the loss values, the distinction and screening between clean and poisoned samples can be achieved.

[0060] In step S1, the specific operation process is as follows:

[0061] In this embodiment, given the dataset RML2016.10a, the modulation classification model used in this invention is 1D-ResNet;

[0062] The RML2016.10a dataset contains 11 modulation categories: 8BPSK, QPSK, 8PSK, 16QAM, 64QAM, BFSK, CPFSK, and PAM4, as well as 3 analog modulations: WB-FM, AM-SSB, and AM-DSB. In this dataset, signal data is represented using complex numbers, consisting of orthogonal signals composed of I-channel and Q-channel data, where I represents the in-phase component and Q represents the quadrature component, with a 90-degree phase difference. The dataset is divided into training, validation, and test sets in a 6:2:2 ratio. High signal-to-noise ratio (SNR) data (above 10 dB) is selected for experiments in both datasets. The training set has a signal size of 44,000, and the test set has a size of 11,000, with the same number of modulation categories. The 1D-ResNet model's network architecture consists of 6 residual blocks and 2 fully connected layers. Each residual block contains 5 convolutional layers, 2 activation layers, and 1 max-pooling layer. The difference between Block 1 and the other 5 residual blocks is that the convolutional layers use two-dimensional convolutional kernels, while the convolutional layers in Blocks 2-6 use one-dimensional convolutional kernels.

[0063] Then, the poisoned data is attacked. Perturbations are generated through PGD iterative attacks and added to the samples to form adversarial examples. The size of the perturbation is limited in each iteration to prevent deviation from the original clean samples. This perturbation interferes with the model's normal classification process, causing clean samples to shift in the feature space and resulting in classification errors. However, poisoned samples are affected by specific triggers and can still activate specific responses in the model under the perturbation, allowing them to be stably classified into the attacker's preset target category. To further distinguish between clean and poisoned samples, the loss function value of the poisoned samples after adding perturbations is calculated. Since poisoned samples maintain high classification accuracy under perturbations, their loss values ​​are usually low; while clean samples exhibit higher loss values ​​due to classification errors caused by perturbations. By sorting and analyzing these loss values, clean and poisoned samples can be effectively distinguished, thereby enabling the screening and identification of potential poisoned samples in the dataset. To generate effective adversarial examples, the PGD algorithm's iteration steps are set to 15, the step size α to 0.03, and the perturbation ε to 0.12.

[0064] S2: After obtaining the poisoned sample, the poisoning score of each layer of the model can be further quantified to assess the sensitivity of each layer to the poisoned sample and its degree of contamination. The calculation of the poisoning score aims to characterize the dependence of each layer of the model on the poisoned sample. The higher the score, the stronger the dependence of the layer on the poisoned sample, thereby determining the magnitude of the effect of the backdoor neurons contained in that layer on the poisoned sample. The specific operation process in step S2 is as follows:

[0065] Reference Figure 1 After successfully identifying the poisoned samples, the sensitivity of each layer to the poisoned samples and its degree of contamination are evaluated by quantifying the poisoning score for each layer. The poisoning score is calculated by analyzing the gradient information of each layer when processing the poisoned samples, reflecting the update direction of the model parameters on the poisoned samples. A higher score indicates a stronger dependence of the layer on the poisoned samples, meaning that the layer's response to the features of the poisoned samples is more significant during model inference. By quantifying the poisoning score, layers that are more susceptible to backdoor attacks are identified and labeled.

[0066] S3: By extracting the feature representations of the key layers, the distribution differences between clean samples and pseudo-poisoned samples in the feature space are obtained. An optimization objective function is designed to align the feature distribution and purify the model layers. By optimizing the structure of the feature space, the model's ability to distinguish clean samples is enhanced, while the influence of poisoned samples on the model is weakened. The labeled clean signal sample classification model is trained using the cross-entropy loss function, and the parameters of the overall classification model are fine-tuned.

[0067] In step S3, the specific operation process is as follows:

[0068] Reference Figure 1The model identifies the λ% layer with the highest poisoning score as the key layer and extracts its feature representation. Then, clean samples are used as triggers to invert and restore the triggers, which are then added to the clean samples to create pseudo-poisoned samples. The model is trained using both clean and pseudo-poisoned samples. During training, clean samples typically form compact and clearly defined clusters in the feature space, while pseudo-poisoned samples, due to the presence of pre-set triggers, may deviate from the distribution of clean samples, forming independent clusters or overlapping with the target class. The feature representation of the key layer is calculated to capture this distribution difference, and an optimization objective function is designed to reduce the intra-class distance of clean samples in the feature space and increase the inter-class distance between poisoned and clean samples. By jointly optimizing these two objectives, the model's feature distribution gradually aligns, the intra-class structure of clean samples becomes clearer, and poisoned samples are pushed away from the distribution area of ​​clean samples, achieving effective model purification. Cross-entropy loss is introduced to ensure that the model's classification performance on clean samples is not compromised, thus maintaining the model's original classification ability on clean samples. By jointly optimizing feature loss and cross-entropy loss, the model can maintain high classification accuracy for clean samples while purifying the feature space.

[0069] S4: Once the classification model's accuracy stabilizes, stop training and save the network parameters of the classification model at this point; test the classification accuracy of the model for normal samples before and after defense, as well as the attack success rate for poisoned samples. The specific operation process in step S4 is as follows:

[0070] The poisoned model is continuously purified to eliminate the influence of backdoor neurons and ensure the model's ability to classify clean samples. Once the accuracy of the classification model stabilizes, training is stopped, and the network parameters of the classification model at this point are saved.

[0071] To test the classification accuracy of the classification models on clean samples and the attack success rate on poisoned samples containing triggers, the classification model structures before and after defense were first loaded. Then, the clean and poisoned sample sets were input into these two classification models respectively. For each model, its classification accuracy on the clean sample set and its attack success rate on the poisoned sample set were calculated. Specifically, classification accuracy is calculated as the ratio of the number of clean samples correctly classified by the model to the total number of clean samples, while the attack success rate is measured as the ratio of the number of times the model was successfully misled on the poisoned sample set to the total number of poisoned samples. By comparing the performance of the models before and after defense on these two metrics, the effectiveness of the defense mechanism can be evaluated.

[0072] The above describes the implementation of the poisoning defense method based on feature difference analysis and model layer purification using the RML2016.10a signal dataset. This invention generates adversarial examples through PGD iterative attacks and uses a loss function to separate clean and poisoned samples. Poisoning scores are calculated for each layer, key layers sensitive to poisoned samples are identified, and their feature representations are extracted. By jointly optimizing the objective function, the intra-class distance of clean samples is reduced, while the inter-class distance between pseudo-poisoned samples and clean samples is increased. Simultaneously, cross-entropy loss is introduced to ensure the model's classification performance on clean samples, achieving effective purification of the model and pushing poisoned samples away from the distribution area of ​​clean samples. In the testing phase, clean test samples are used to evaluate the model's classification accuracy on clean samples, and poisoned test samples with triggers are used to evaluate the model's attack success rate on poisoned samples, comprehensively evaluating the model's defense performance. This invention utilizes the addition of adversarial perturbations and the difference in function loss values ​​to screen samples, enabling it to accurately identify potential poisoned samples in the dataset, calculate layer poisoning scores, quantify the sensitivity of each layer of the model to poisoned samples, and identify key layers that are easily affected by poisoning attacks. While improving the accuracy of signal classification, it significantly enhances the model's defense against poisoning.

[0073] This invention is illustrative only and not restrictive. Those skilled in the art will understand that many changes, modifications, and even equivalents can be made within the spirit and scope defined by the claims, all of which will fall within the protection scope of this invention.

Claims

1. A poisoning defense method based on feature difference analysis and model layer purification, characterized in that, The method includes the following steps: S1: Construct a classification model based on electromagnetic signal samples, and perform poisoning training on the signal classification model, saving the trained poisoning classification model; acquire signal samples with poisoning risk, introduce adversarial perturbations into these samples, and through the perturbation mechanism, clean samples will be misclassified due to the interference of the perturbation, while poisoned samples will still be classified into the target category due to the presence of a preset trigger; then calculate the cross-entropy loss function value of the poisoned samples after adding perturbation, sort the loss values, and set a threshold to achieve the separation of clean samples and poisoned samples; S2: After the poisoned samples are separated, the poisoning score of each layer of the model can be further quantified to assess the sensitivity of each layer to the poisoned samples and the degree of contamination. S3: The restored trigger is inverted using a trigger, and the restored trigger is added to the clean samples to generate pseudo-poisoned samples. By extracting key layer feature representations, the distribution difference between clean samples and pseudo-poisoned samples in the feature space is obtained. An optimization objective function is designed to align the feature distribution and purify the model layer. By optimizing the structure of the feature space, the model's ability to distinguish clean samples is enhanced, while the influence of poisoned samples on the model is weakened. Labeled clean signal samples are input into the classification model, and the cross-entropy loss function is used for training to fine-tune the parameters of the overall classification model. S4: Repeat S3. Once the accuracy of the classification model stabilizes, stop training and save the network parameters of the classification model at this point. Test the classification accuracy of the classification model for normal samples before and after defense, as well as the attack success rate for poisoned samples.

2. The poisoning defense method based on feature difference analysis and model layer purification as described in claim 1, characterized in that, The process of step S1 is as follows: First, a training set consisting of modulated signals is constructed. Where x i Let y represent the i-th signal sample. i This represents the label corresponding to the training sample, k is the total number of categories, t is a specific category, and N is the number of categories. tr Let x be the total number of samples, and x be the number of each signal sample. i These are all IQ vectors, obtained from discrete complex signals after preprocessing, as shown below: x i =I i +jQ i (1) Wherein, the real part is defined as I i The imaginary part is defined as Q. i Combine them to form a two-dimensional real-valued vector; Define the trigger as Δ, the target class as t, and inject the trigger into the training set at a rate of γ∈(0,1) to generate a poisoned sample set, i.e.: N P =γ·N tr (3) in, This indicates that the generated poisoned samples have their labels changed to the target category t of the attack, thus obtaining the poisoned sample set. N P This represents the number of poisoned samples in the training set. The poisoned samples and the remaining clean samples are then merged into a mixed training set D. mix ,Right now: D mix =D P ∪ D C (4) Among them, D C This is the remaining clean sample set; Based on the hybrid training set D mix By minimizing the cross-entropy loss function Training the poisoning model f θ,L (·), the optimization objective is: The specific form of the cross-entropy loss function is: in, The cross-entropy loss is used, where N represents the total number of classes contained in the training samples; y ij p represents the true label of whether the i-th sample belongs to the j-th class, with a value of 0 or 1; j (x i ) indicates that the model will x i The probability of predicting the class j is used to train the poisoning model f. θ,L (·), where θ represents the model parameters of the poisoning model, and L is the number of layers in the model.

3. The poisoning defense method based on feature difference analysis and model layer purification as described in claim 2, characterized in that, Step S1 also includes the following process: Adversarial perturbations are added to the samples using the projected gradient descent method, implemented through multiple iterations. Each iteration applies only a small perturbation to the samples, ensuring that the perturbation after each iteration is constrained within a preset norm constraint. The process is as follows: in, Let x be the sample after M iterations, and T be the total number of iterations. When M = 0, the initial sample is x. i y i This indicates the corresponding label. The cross-entropy loss function is applied to the input. The gradient of the input vector is given by , where sign(·) is the sign function, and its output is the sign of each component of the input vector, i.e., ±1, used to ensure that the perturbation direction is consistent with the gradient direction. α represents the step size, controlling the perturbation amplitude in the gradient direction, and ∈ represents the maximum perturbation magnitude. The adversarial example after iteration is denoted as .

4. The poisoning prevention method based on feature difference analysis and model layer purification as described in claim 3, characterized in that, In step S1, since the trigger Δ still maintains its activation characteristics on the signal after the perturbation, the poisoned sample will still be classified into the target category after the perturbation, while the clean sample will be misclassified after being perturbed. By calculating the loss function value of the poisoned sample after the perturbation and sorting these loss values, the clean sample and the poisoned sample can be distinguished. The sample with the higher loss value is identified as the clean sample, while the sample with the lower loss value is identified as the poisoned sample. Among them, S clean and S poisoned This represents the selected clean sample set and the poisoned sample set. P is expressed as the cross-entropy loss of the samples. η (L) represents the clean loss threshold; samples with a loss value higher than this threshold are considered clean samples; P β (L) represents the poisoning loss threshold. Samples with a loss value lower than this threshold are classified as poisoned samples.

5. The poisoning defense method based on feature difference analysis and model layer purification as described in any one of claims 1 to 4, characterized in that, The process of step S2 is as follows: After screening, the poisoned sample set S was obtained. poisoned Subsequently, to quantify the degree of influence of poisoned samples on each layer of the model, a layer poisoning score (LPS) was defined. The LPS reflects the gradient difference and rank change of a particular layer when processing poisoned and clean samples. Based on the LPS, the number N layers with a greater impact from poisoning was further determined. p This refers to the layer that requires intensive purification. Among them, LPS l The poisoning score is the value of the layer l ∈ (1,2,...,L). The gradient matrix of the poisoned sample at layer l is f. l For the feature output of the sample at layer l, Rank(f) l Let be the rank of the feature matrix of the l-th layer. A weighted sum is taken of the rank of the feature matrix and the L1 norm of the gradient matrix, with coefficients α and β respectively. The layer poisoning score is then obtained, and the layer requiring purification is selected based on this score, as shown in the following formula: Wherein, λ% is a preset threshold ratio, reflecting the proportion of high-level features that need to be purified. λ％ (·) indicates that the top λ% of the highest-scoring layers are taken, denoted as L. critical And mark it as a key layer.

6. The poisoning defense method based on feature difference analysis and model layer purification as described in any one of claims 1 to 4, characterized in that, The process of step S3 is as follows: For the poisoned model, any input containing a trigger will be predicted as the target label, indicating that neurons activated by the trigger dominate the feature space. Therefore, the activation of poisoned samples shows a significant difference in value compared to clean samples. Thus, during the defense process, by extracting the feature values ​​of key layers of the model, the distributions of clean and poisoned samples in the feature space can be obtained separately. By comparing and analyzing the differences in their distributions, the degree of shift of poisoned samples in the feature space can be quantified. To obtain the poisoned samples corresponding to the clean samples, the target category is first extracted from the separated poisoned samples. Then, trigger inversion is performed based on the clean samples to restore the triggers required to generate the poisoned samples, and these triggers are added to the clean samples to form pseudo-poisoned samples. The separated clean sample set S is then used... clean To invert a trigger, the process is as follows: x i k+1 =(1-m k )·x i k +m k ·Δ k (13) Wherein, the initial sample is (x i ,y i )∈S clean m k The binary mask for the k-th iteration is used to determine the trigger position, Δ. k Let x represent the trigger for the k-th iteration. i k+1 The pseudo-poisoned sample is generated after the k-th iteration. Let γ be the cross-loss entropy, γ be a hyperparameter controlling the regularization weights, ||·||1 be the L1 norm used to achieve mask sparsity, and Δ be the cross-loss entropy. * and m * These are the trigger and mask after the iteration is complete; Design a feature loss function to minimize the distribution difference between clean samples and pseudo-poisoned samples in the feature space, thereby achieving feature space purification of poisoned samples. The designed feature loss is: in, k∈L critical This represents the feature output of the sample at the key layer, where the input sample (x) is the key layer. i ,y i )∈S clean ; By introducing cross-entropy loss as a classification loss to maintain the model's original classification ability on clean samples, and by jointly optimizing the feature loss and cross-entropy loss, we can maintain the model's high classification accuracy on clean samples while purifying the feature space, and fine-tune the parameters of the overall classification model during training.

7. The poisoning defense method based on feature difference analysis and model layer purification as described in any one of claims 1 to 4, characterized in that, In step S4, S3 is repeated to continuously purify the poisoned model, eliminate the influence of backdoor neurons, and ensure the model's ability to classify clean samples. Once the accuracy of the classification model is stable, training is stopped, and the network parameters of the classification model at this time are saved.

8. The poisoning defense method based on feature difference analysis and model layer purification as described in claim 7, characterized in that, In step S4, the classification accuracy of the model for clean samples and the attack success rate for poisoned samples containing triggers are tested. First, the classification model structures before and after defense are loaded respectively, and the test clean sample set is used. With poisoning sample set Input the data into each classification model separately, and calculate the classification accuracy (ACC) for clean samples and the attack success rate (ASR) for poisoned samples before and after defense, respectively. The formulas are as follows: Where f(·) represents the classification model to be tested after purification. This represents a clean test sample. N represents the poisoning test sample. test This represents the total number of samples contained in the test set. This indicates whether the model's predicted label is equal to the actual label.

Images