Backdoor attack defense method for flow matching model, medium and device

Abstract

A backdoor attack defense method for a flow matching model, a medium and equipment are disclosed, including: providing a first hidden space feature of a normal sample to a first neural network for backdoor trigger infection processing, obtaining a second hidden space feature; the first hidden space feature and the second hidden space feature are respectively provided to the neural network for fitting the velocity field in the first flow matching model and the second flow matching model, obtain the first velocity field and the second velocity field;According to the consistency constraint of the first velocity field and the second velocity field, the model parameters of the second flow matching model are adjusted, and the flow matching model repaired by the backdoor vulnerability is obtained.The present disclosure can avoid the phenomenon that the flow matching model infected by the backdoor trigger is discarded, thereby avoiding the waste of time cost, labor cost and calculation cost caused by retraining the flow matching model, and further reducing the use cost of the flow matching model while ensuring the robustness of the flow matching model.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to a backdoor attack defense method for flow matching models, a computer-readable storage medium, and an electronic device. Background Technology

[0002] Backdoor attacks are a type of malicious attack technique in the field of artificial intelligence. By implanting a hidden "backdoor" into a model, the model behaves normally under normal input conditions, but outputs a malicious result predetermined by the attacker when a specific trigger is received.

[0003] Current backdoor attacks are categorized into two types based on their implantation methods: data poisoning-based backdoor attacks and model poisoning-based backdoor attacks. Data poisoning-based backdoor attacks involve embedding triggers into samples, causing the model to establish a correlation between the triggers and backdoor labels during training. This ensures that the model's prediction for any sample containing a trigger will be the backdoor label. Model poisoning-based backdoor attacks involve modifying the model's structure or parameters to directly implant a backdoor into the model.

[0004] For discriminative models, current backdoor attack defense methods, based on different defense phases, are divided into three categories: backdoor attack defense during the data collection phase, backdoor attack defense during the model deployment phase, and backdoor attack defense during the input prediction phase. Backdoor attack defense during the data collection phase involves cleaning and augmenting the dataset to remove potential backdoor attack risks before model training. Backdoor attack defense during the model deployment phase analyzes the model's parameters and behavior to detect and remove backdoors hidden within the model. Backdoor attack defense during the input prediction phase analyzes the statistical differences in the model's output results for normal samples and backdoor samples with triggers to identify and reject predictions for backdoor samples.

[0005] However, due to the differences in the working mechanisms between discriminative and generative models, the aforementioned backdoor attack defense methods targeting discriminative models are difficult to directly apply to generative models. Considering the powerful AIGC (Artificial Intelligence Generated Content) capabilities of generative models, manipulating them to generate malicious content through backdoor attacks could have incalculable and serious consequences. Therefore, how to implement backdoor attack defense against generative models is a technically significant issue. Summary of the Invention

[0006] To address the aforementioned technical problems, this disclosure is proposed. Embodiments of this disclosure provide a backdoor attack defense method, storage medium, and electronic device based on a flow matching model.

[0007] According to a first aspect of the present disclosure, a backdoor attack defense method for a flow matching model is provided. The method includes: a flow matching model backdoor vulnerability repair process, wherein the flow matching model backdoor vulnerability repair process includes: providing a first latent space feature of a normal sample to a first neural network, wherein the first neural network performs backdoor trigger infection processing on the first latent space feature to obtain a second latent space feature; providing the first latent space feature to a second neural network in a first flow matching model for fitting velocity fields of an initial data distribution and a target data distribution to obtain a first velocity field; and providing the second latent space feature to a third neural network in a second flow matching model for fitting velocity fields of an initial data distribution and a target data distribution to obtain a second velocity field; wherein the first flow matching model is a flow matching model infected by a backdoor trigger, and the first flow matching model and the second flow matching model are replicas of each other; adjusting the network parameters of the third neural network according to the consistency constraints of the first velocity field and the second velocity field; and obtaining a flow matching model with the backdoor vulnerability repaired according to the adjusted third neural network.

[0008] According to a second aspect of the present disclosure, a computer-readable storage medium is provided, the storage medium storing a computer program for implementing the above-described method.

[0009] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described above.

[0010] Based on the backdoor attack defense method, storage medium, and electronic device provided in the above embodiments of this disclosure for a flow matching model, by setting a first neural network to perform backdoor trigger infection processing on the first latent space features of normal samples, a second latent space feature infected by the backdoor trigger can be obtained; by using a first flow matching model and a second flow matching model that are replicas of each other to perform velocity field fitting processing on the first latent space feature and the second latent space feature respectively, the velocity fields corresponding to the two latent space features in the two flow matching models can be obtained; by using consistency constraints on the first velocity field and the second velocity field to adjust the network parameters of the third neural network, the second flow matching model can be forced to adjust the generation path of the latent space feature infected by the backdoor trigger in accordance with the... The first-stream matching model maintains a consistent generation path for normal latent space features, thus helping to prevent the flow matching model infected by backdoor triggers from being triggered by them. In other words, it effectively shields the backdoors reserved for backdoor triggers in the flow matching model, preventing the model from responding to backdoor triggers in samples. Therefore, the technical solution provided in this disclosure helps to fix backdoor vulnerabilities in flow matching models, avoiding the abandonment of flow matching models infected by backdoor triggers. This avoids the waste of time, manpower, and computational costs caused by retraining the flow matching model, thereby ensuring the robustness of the flow matching model against backdoor attacks while reducing the cost of using the flow matching model.

[0011] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0012] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 This is a schematic diagram illustrating an application scenario of the backdoor attack defense method based on the flow matching model disclosed herein.

[0014] Figure 2 This diagram illustrates the execution sequence of the five parts in the backdoor attack defense method based on the flow matching model disclosed herein.

[0015] Figure 3 This is a flowchart of an embodiment of the backdoor vulnerability repair process in the backdoor attack defense method based on the flow matching model disclosed herein;

[0016] Figure 4 This is a flowchart of an embodiment of the training process of the first neural network in the backdoor attack defense method based on the flow matching model disclosed herein;

[0017] Figure 5 This is a flowchart of an embodiment of the process for determining whether the first flow matching model is infected by a backdoor trigger in the backdoor attack defense method for the flow matching model disclosed herein;

[0018] Figure 6 This is a flowchart of an embodiment of the training process of the fourth neural network in the backdoor attack defense method based on the flow matching model disclosed herein;

[0019] Figure 7 This is a structural diagram of an electronic device provided in an exemplary embodiment of this disclosure. Detailed Implementation

[0020] Example embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. It is obvious that the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure, and it should be understood that this disclosure is not limited to the example embodiments described herein.

[0021] This disclosure outlines

[0022] In realizing this disclosure, the inventors discovered that flow matching models and diffusion generation models are two important branches in the field of generative model technology. Flow matching models represent a significant breakthrough in generative artificial intelligence technology in recent years. With its unique probabilistic path matching mechanism, flow matching models are reshaping the development landscape of generative models. Compared to the traditional diffusion generation model's generation paradigm, which relies on Gaussian noise for gradual denoising, flow matching models can achieve a more efficient and stable arbitrary distribution mapping process by directly constructing a continuous probability flow from the data distribution to the prior distribution. This continuous probability flow mechanism not only significantly improves generation quality but also demonstrates broad application prospects in various industries such as image generation, molecular design, and text generation due to its strong scalability and high computational efficiency. However, with the rapid deployment of flow matching models in various industries, some potential security vulnerabilities are becoming key bottlenecks restricting the development and application of flow matching models. Among them, backdoor attacks, which are highly concealed and have a high success rate, pose a particularly prominent threat to flow matching models.

[0023] Currently, there are no technologies related to backdoor attack defense for flow matching models. The following analysis examines whether backdoor attack defense techniques for diffusion generation models can be used to counter backdoor attacks on flow matching models.

[0024] Backdoor attacks on diffusion-generative models typically involve attackers implanting malicious triggers during the model training phase. This causes the model to output pre-defined results to inputs containing specific backdoor patterns (such as images, text, or noise samples containing triggers), while simultaneously maintaining its ability to generate high-quality normal samples. Based on the different backdoor triggering mechanisms, backdoor attacks on diffusion-generative models can be categorized into Gaussian noise-based attacks and cue-based attacks. Gaussian noise-based attacks introduce malicious noise patterns related to the triggers during denoising, causing the model to produce abnormal results in response to noise carrying the triggers. Cue-based attacks embed backdoors directly within cue words to manipulate the model and generate abnormal results.

[0025] From the perspective of the principle of backdoor attacks against diffusion generation models, the essence is to create a certain distribution drift between the normal data distribution and the backdoor data distribution. Therefore, backdoor attack defense against diffusion generation models can be achieved by utilizing data distribution correction. For example, by designing differentiated backdoor trigger reconstruction mechanisms and data distribution correction strategies, backdoor attacks against diffusion generation models can be defended.

[0026] However, the flow matching model employs a generation mechanism that involves transmission between arbitrary distributions. This means it models the gradient information of the probability flow to achieve a flow mapping from simple to complex data distributions, thus completing the generation process. The backdoor attack defense methods of the aforementioned diffusion generation model primarily address backdoor attacks via injecting triggers into the noisy space, and are unsuitable for the flow matching model's generation mechanism that involves transmission between arbitrary distributions.

[0027] The inventors discovered that the essence of backdoor attacks on flow matching models lies in the offset between the generation path corresponding to normal input and the generation path corresponding to abnormal input. When defending against backdoor attacks on flow matching models, if the generation path corresponding to abnormal input can be corrected, it will help to prevent the flow matching model from responding to backdoor triggers without affecting the quality of sample generation for normal input, thereby fixing the backdoor vulnerability of the flow matching model and improving its robustness.

[0028] Exemplary Overview

[0029] The backdoor attack defense technique based on the stream matching model disclosed herein can be applied to image generation, video generation, and audio generation applications. A specific example of the backdoor attack defense technique based on the stream matching model disclosed herein is applicable to image generation applications, such as... Figure 1 As shown.

[0030] Figure 1In this scenario, user 100 obtains a pre-trained stream matching model 102 and has image samples from a downstream task. User 100 also knows they possess a small number of normal image samples 101. User 100 wants to use these downstream task image samples to generate a large number of samples using the stream matching model 102. Since user 100 is unsure whether the obtained stream matching model 102 is infected with a backdoor trigger, to ensure the security of the generated samples obtained using the stream matching model 102, user 100 should first verify whether the stream matching model 102 is infected with a backdoor trigger before generating a large number of samples using their image samples and the stream matching model 102. If the verification result shows that the stream matching model 102 is not infected with a backdoor trigger, the sample generation operation can be performed directly using the stream matching model 102. If the verification result shows that the stream matching model 102 is infected with a backdoor trigger, the backdoor trigger infection problem of the stream matching model 102 should be resolved first before performing the sample generation operation using the stream matching model 102. The specific process can be seen in the following description:

[0031] First, user 100 provides multiple (e.g., partial or complete) normal image samples 101 to codec 103, which encodes (i.e. maps) each normal image sample 101 to obtain the latent space features 104 of each normal image sample 101. The codec 103 can be the codec in the stream matching model 102.

[0032] Secondly, user 100 provides some or all of the latent space features 104 to the backdoor trigger infection model 105, and the backdoor trigger infection model 105 performs backdoor trigger infection processing on each of the received latent space features 104, thereby obtaining multiple latent space features 106 infected by the backdoor trigger.

[0033] Next, user 100 replicates the flow matching model 102 to obtain a copy model 102-1 of the flow matching model 102. User 100 can provide latent space features 104 to the flow matching model 102 and latent space features 106 to the copy model 102-1. The flow matching model 102 performs sample generation processing based on each latent space feature 104 received, and the copy model 102-1 performs sample generation processing based on each latent space feature 106 received.

[0034] Next, user 100 uses backdoor risk detection model 107 to perform backdoor risk detection processing on the process of sample generation by flow matching model 102 and the process of sample generation by replica model 102-1 (e.g., providing relevant information on sample generation by flow matching model 102 and sample generation by replica model 102-1 to backdoor risk detection model 107, which then performs backdoor risk discrimination processing on the received information). Based on the risk discrimination result output by backdoor risk detection model 107 (e.g., the confidence level of infection by backdoor trigger), user 100 determines whether flow matching model 102 is infected by backdoor trigger. If the determination result is that flow matching model 102 is not infected by backdoor trigger, sample generation operation can be directly performed using flow matching model 102 or replica model 102-1. If the determination result is that flow matching model 102 is infected by backdoor trigger, the following repair and security hardening processes are then performed.

[0035] Repair process: User 100 provides latent space feature 104 to the flow matching model 102 and latent space feature 106 to the replica model 102-1. By using the principle of forcing the consistency between the generation path of the replica model 102-1 based on latent space feature 106 and the generation path of the flow matching model 102 based on latent space feature 104, the model parameters of the replica model 102-1 are adjusted until the repair process is successfully completed. At this time, the replica model 102-1 is the repaired flow matching model.

[0036] Security hardening process: The repaired copy model 102-1 is used as the teacher model, and the student model 102-2 is trained using the teacher model. The successfully trained student model 102-2 is the flow matching model after security hardening.

[0037] User 100 can use the security-hardened stream matching model to perform sample generation operations. During the sample generation operation, regardless of whether the image sample provided to the downstream task of the security-hardened stream matching model is a normal image sample, the stream matching model will generate the corresponding generated sample according to the normal generation path, and will not generate the generated sample corresponding to the backdoor trigger according to the abnormal generation path.

[0038] Exemplary methods

[0039] The backdoor attack defense method for flow matching models disclosed herein mainly includes five parts: the backdoor vulnerability repair process for the flow matching model, the training process of the first neural network, the process of determining whether the first flow matching model is infected by a backdoor trigger, the training process of the fourth neural network, and the security hardening process of the flow matching model. In one example, these five parts can be arranged as follows: Figure 2The execution order is shown below. The five parts described above will be explained in detail below with reference to the accompanying drawings.

[0040] (I) Process of patching backdoor vulnerabilities in flow matching models

[0041] Figure 3 This is a flowchart illustrating an embodiment of the backdoor vulnerability repair process in the backdoor attack defense method based on the flow matching model disclosed herein. Figure 3 In the illustrated embodiment, the first flow matching model is a flow matching model confirmed to be infected by a backdoor trigger. For example, the process for determining whether a flow matching model is infected by a backdoor trigger, provided in this disclosure, can be used to determine whether the first flow matching model is an infected flow matching model; another example is being explicitly informed that the first flow matching model has been infected by a backdoor trigger; yet another example is testing the first flow matching model using known samples with backdoor triggers to determine that it is an infected flow matching model. This disclosure does not limit the method for confirming that the first flow matching model is infected by a backdoor trigger. Figure 3 In the embodiments shown, the backdoor triggers infected by the first-stream matching model include known backdoor triggers. For example, the training process of the first neural network disclosed herein can enable the first neural network to learn the specific behavior of the backdoor triggers infected by the first-stream matching model; or, for example, the specific behavior of the backdoor triggers infected by the first-stream matching model is explicitly disclosed; or, for example, the specific behavior of the backdoor triggers infected by the first-stream matching model is tested using known samples with backdoor triggers. Figure 3 The method shown mainly includes steps S300, S301, S302, and S303. The following is a description of... Figure 3 Each step in the process will be explained separately.

[0042] S300. The first latent space features of the normal samples are provided to the first neural network, and the first neural network performs backdoor trigger infection processing on the first latent space features to obtain the second latent space features.

[0043] In this disclosure, normal samples refer to samples that are not infected with backdoor triggers. For example, normal samples are image samples without backdoor trigger patterns. Normal samples can be training samples for downstream tasks of the pre-trained flow matching model. Of course, this disclosure does not exclude the possibility that normal samples are samples used for pre-training the flow matching model. The first latent space feature in this disclosure refers to the potential characteristics or attributes exhibited by normal samples in the latent space, and this latent space is usually a multi-dimensional space. The first latent space feature can also be called the normal latent space feature.

[0044] This disclosure utilizes an encoder / decoder to encode normal samples, thereby mapping the normal samples into the latent space and obtaining the first latent space features of the normal samples. The encoder / decoder can be the encoder / decoder in a first-stream matching model. This disclosure does not limit the specific implementation method for obtaining the first latent space features of normal samples. Obtaining the first latent space features using an encoder can be expressed as the following formula (1):

[0045]

[0046] In the above formula (1), Z t X represents the first latent space feature, that is, the latent space feature obtained by the encoder after processing a normal sample at time t; Encoder(.) represents the encoding process of the encoder; X t This represents the encoder's input sample (i.e., the normal sample) at time t; This indicates that t is in the range [0,1].

[0047] The first neural network in this disclosure refers to a neural network used to infect the input latent space features with a backdoor trigger. The first neural network typically utilizes the features of the backdoor trigger learned during its training process to infect the input latent space features with the backdoor trigger. That is, the first neural network uses the features of the backdoor trigger learned during training to perform backdoor trigger infection processing on the input latent space features. The output of the first neural network is the second latent space feature infected by the backdoor trigger; this second latent space feature can be called an anomalous latent space feature. The training process of the first neural network can be found in the following section... Figure 4 The description of the first neural network is as follows: The first neural network performs backdoor trigger infection processing on the first latent space features of the input, which can be expressed in the form of the following formula (2):

[0048]

[0049] In the above formula (2), X represents the second latent space feature, which is the abnormal latent space feature formed after the normal latent space feature obtained by the encoder processing of the normal sample at time t is infected by the backdoor trigger of the first neural network; Encoder(.) represents the encoding process of the encoder; X t This represents the encoder's input sample (i.e., the normal sample) at time t; g Ψ (.) indicates the backdoor trigger infection handling of the first neural network; This indicates that t is in the range [0,1].

[0050] This disclosure allows the use of an encoder and a first neural network to process multiple (e.g., n, where n is an integer greater than 2) normal samples separately, thereby obtaining n first latent space features and n second latent space features. The n first latent space features can be represented as a set {(Z0, Z1, ..., Z...} n The n second latent space features can be represented as a set.

[0051] S301. The first latent space features are provided to the second neural network in the first flow matching model for fitting the velocity fields of the initial data distribution and the target data distribution to obtain the first velocity field, and the second latent space features are provided to the third neural network in the second flow matching model for fitting the velocity fields of the initial data distribution and the target data distribution to obtain the second velocity field.

[0052] The first and second flow matching models in this disclosure are both flow matching models infected by a backdoor trigger, and they are copies of each other. That is, the model structures of the first and second flow matching models are exactly the same, and their model parameters are also exactly the same before executing the method of this disclosure. In addition, the model structure of the first flow matching model in this disclosure can be any existing flow matching model structure. The first flow matching model typically includes: an encoder / decoder and a neural network for fitting the velocity field of the input sample data distribution and the generated sample data distribution, etc. In this disclosure, the neural network in the first flow matching model for fitting the velocity field of the input sample data distribution and the generated sample data distribution is called the second neural network, and the neural network in the second flow matching model for fitting the velocity field of the input sample data distribution and the generated sample data distribution is called the third neural network, and the second and third neural networks are typically deep neural networks.

[0053] The second neural network fits a velocity field based on the first latent space features, which are its current model parameters as input. In this disclosure, this velocity field can represent the first generation path (i.e., the normal generation path) corresponding to the first latent space features. Similarly, the third neural network fits a velocity field based on the second latent space features, which are its current model parameters as input. In this disclosure, this velocity field can represent the second generation path (i.e., the backdoor generation path) corresponding to the second latent space features.

[0054] S302. Adjust the network parameters of the third neural network according to the consistency constraints of the first and second velocity fields.

[0055] This disclosure does not adjust the network parameters of the second neural network in the first-flow matching model, but only adjusts the network parameters of the third neural network in the second-flow matching model. That is, while keeping the first-flow matching model unchanged, this disclosure continuously adjusts the network parameters of the third neural network so that the way the third neural network processes abnormal latent space features is closer to the way the second neural network processes normal latent space features.

[0056] Assume the second neural network in the first-flow matching model uses This indicates that the third neural network in the second-flow matching model uses v θ Therefore, the consistency constraint of the first velocity field and the second velocity field in this disclosure can be expressed in the form of the following formula (3):

[0057]

[0058] In the above formula (3), This indicates that the model parameter θ is obtained by solving for the parameter that minimizes the value of the subsequent expression; Indicated based on t, Z0, Z1, as well as The joint distribution is used to solve for the mathematical expectation; This indicates that the Bregman divergence is used to measure the difference between vectors u and v, and Φ(u) can be a strictly convex function. Indicates measurement and The differences between them; This indicates that for the latent variable combination (1-t)Z0+tZ1,t, the first-order matching model uses the interpolation parameter t to interpolate, thereby generating different samples, and This represents the velocity field function of the first-order matching model; This indicates the combination of latent variables. In contrast, the second-flow matching model uses the interpolation parameter t for interpolation to generate different samples; and v θ (.) denotes the velocity field function of the second-flow matching model; ω represents the consistency constraint term, used to prevent the second-flow matching model from reducing the generation quality of normal samples during the adjustment of the third neural network parameters; ω is an adjustable balancing coefficient used to balance the loss term based on Bregman divergence and the consistency constraint loss term. The weights between them can be adjusted by ω to control the backdoor generation path of the second-flow matching model for the second latent space features to align with the normal generation path while taking into account the generation quality of the second-flow matching model for normal samples; Z0 represents the latent space features of the 0th normal sample; Z1 represents the latent space features of the 1st normal sample. This represents the abnormal latent space features after the latent space features of the 0th normal sample are infected by a backdoor trigger. θ represents the abnormal latent space features of the first normal sample after being infected by the backdoor trigger; θ represents the model parameters of the second-flow matching model; θ0 represents the model parameters of the first-flow matching model.

[0059] S303. Based on the adjusted third neural network, a flow matching model that has fixed the backdoor vulnerability is obtained.

[0060] This disclosure, through continuous adjustment of the network parameters of the third neural network, makes the generation path formed by the second flow matching model for latent space features infected by the backdoor trigger increasingly closer to the generation path formed by the first flow matching model for latent space features not infected by the backdoor trigger. When the degree of closeness between the two meets certain conditions, they are considered to be consistent. Before the backdoor vulnerability is patched, the generation path formed by the second flow matching model for latent space features infected by the backdoor trigger can be considered a backdoor generation path, while the generation path formed by the flow matching model after patching the backdoor vulnerability for latent space features infected by the backdoor trigger can be considered a normal generation path. The flow matching model after patching the backdoor vulnerability can be directly used for sample generation processing of downstream tasks, or the flow matching model after patching the backdoor vulnerability can be further security-hardened before being used for sample generation processing of downstream tasks.

[0061] (II) Training process of the first neural network

[0062] Whether in the process of determining whether a flow matching model is infected by a backdoor trigger, the training process of the fourth neural network, the process of repairing backdoor vulnerabilities in the flow matching model, or the process of security hardening of the flow matching model, it is necessary to use the latent space features of normal samples (i.e., normal latent space features) and the abnormal latent space features infected by backdoor triggers. However, the manifestations of backdoor triggers are usually diverse. When the backdoor triggers infected by the flow matching model are unknown, before repairing and hardening the infected flow matching model, it is necessary to first determine whether the flow matching model is infected by a backdoor trigger and the specific manifestation of the backdoor triggers infected by the flow matching model. Only then can the latent space features of normal samples be targeted for backdoor trigger infection processing in order to obtain the corresponding latent space features infected by backdoor triggers.

[0063] In the absence of an unknown backdoor trigger infected by the flow matching model, this disclosure enables the first neural network to learn the specific manifestation of the backdoor trigger infected by the flow matching model during the training process, and the first neural network does not belong to the flow matching model. Figure 4 This is a flowchart illustrating an embodiment of the training process of the first neural network in the backdoor attack defense method based on the flow matching model disclosed herein, and Figure 4 The method shown mainly includes the following steps: S400, S401, S402, S403, S404, S405, S406, and S407. The following section details... Figure 4 Each step in the process will be explained separately.

[0064] S400, Begin the training process of the first neural network.

[0065] Specifically, the network parameters of the first neural network to be trained can be initialized first. This initialization process can include setting the network parameters of the first neural network to be trained to initial values, or it can include providing a small number of samples to the first neural network to be trained to adjust the network parameters. The network parameters of the first neural network to be trained typically include: parameters describing the characteristics of the backdoor trigger (which can be called backdoor trigger parameters). In one example, the parameters describing the characteristics of the backdoor trigger may include, but are not limited to: parameters describing the location of the backdoor trigger, parameters describing the content of the backdoor trigger, parameters describing the size of the backdoor trigger, and parameters describing the shape of the backdoor trigger. The parameters describing the location of the backdoor trigger can represent the positional characteristics of the backdoor trigger in the latent space. The parameters describing the content of the backdoor trigger can represent the content characteristics of the backdoor trigger in the latent space. The parameters describing the size of the backdoor trigger can represent the size characteristics of the backdoor trigger in the latent space. The parameters describing the shape of the backdoor trigger can represent the shape characteristics of the backdoor trigger in the latent space. By setting parameters to describe the characteristics of the backdoor trigger based on its location, content, size, and shape, it is beneficial to accurately define the backdoor trigger, thereby enabling the backdoor trigger learned by the first neural network to realistically reproduce the backdoor trigger infected by the flow matching model.

[0066] S401. Obtain the third latent space features of at least one normal sample.

[0067] Specifically, this disclosure can be derived from the above set {(Z0, Z1, ..., Z...} nAt least one third latent space feature is selected from S300, and the third latent space feature may be different from the first latent space feature in S300. Alternatively, this disclosure may select multiple normal samples from the normal sample set and encode each normal sample separately using the encoder and decoder in the first-stream matching model to obtain the third latent space feature of each normal sample, and each third latent space feature is a latent space feature that has not been infected by the backdoor trigger, i.e., a normal latent space feature.

[0068] S402. Provide the third latent space features of each normal sample to the first neural network to be trained, and the first neural network to be trained performs backdoor trigger latent space feature infection processing on the third latent space features to obtain at least one fourth latent space feature.

[0069] Specifically, the process by which the first neural network to be trained obtains the fourth latent space features can be expressed as the above formula (2). The fourth latent space features can be called anomalous latent space features or backdoor latent space features.

[0070] S403. Each third latent space feature and each fourth latent space feature are respectively provided as inputs to the second neural network in the first-flow matching model. The second neural network performs velocity field fitting processing on each third latent space feature and each fourth latent space feature to obtain the third velocity field corresponding to each third latent space feature and the fourth velocity field corresponding to each fourth latent space feature.

[0071] The first-order matching model here can be a pre-trained flow matching model or a flow matching model already used in downstream tasks. The second neural network in this process is the neural network in the first-order matching model used to fit the velocity field. Since the essence of the backdoor attack of the flow matching model lies in the offset between the normal generation path formed for normal samples and the backdoor generation path formed for infected samples, there is a difference between the velocity field fitted by the second neural network in the first-order matching model for normal latent space features and the velocity field fitted for infected abnormal latent space features. This difference can be expressed by the following formula (4):

[0072]

[0073] In the above formula (4), Δ(Z) t ,Ψ,t) represents the difference between the velocity field fitted by the second neural network with normal latent space features at time t (i.e., the third velocity field) and the velocity field fitted by the second neural network with latent space features formed by the first neural network to be trained based on the parameters Ψ currently used to describe the features of the backdoor trigger (i.e., the fourth velocity field). This represents the second neural network v θAt time t, the velocity field is fitted to the latent space features of the first neural network to be trained based on the parameters Ψ currently used to describe the features of the backdoor trigger; v θ (Z t ,t) represents the second neural network v θ At time t, the velocity field is fitted with the normal latent space characteristics; Represents the square of the Euclidean norm; The range of time t is [0,1].

[0074] If the first-order matching model is not infected by the backdoor trigger, then the difference Δ(Z) between the two velocity fields mentioned above t ,Ψ,t)≈0; If the first-flow matching model is infected by a backdoor trigger, then under a specific parameter Ψ, the difference Δ(Z) between the two velocity fields mentioned above is 0. t ,Ψ,t) will increase significantly.

[0075] S404. Calculate the loss based on the difference between the third and fourth velocity fields, and use the result of the loss calculation to update the network parameters of the first neural network to be trained.

[0076] Specifically, this disclosure can utilize the loss caused by the difference between the third and fourth velocity fields to construct a network parameter optimization problem, and update the network parameters of the first neural network to be trained by solving the end-to-end optimization problem. That is, the solution to the network parameter optimization problem can be used as the network parameters of the first neural network to be trained obtained in this iteration of training.

[0077] In one example, this disclosure can construct the network parameter optimization problem of the first neural network to be trained based on the backdoor trigger reconstruction loss, the backdoor profit maximization loss, and the sparse regularization operator in the high-dimensional space, and the network parameter optimization problem can be expressed in the form of the following formula (5):

[0078]

[0079] In the above formula (5), This represents the network parameters learned by the first neural network to be trained in the current iteration; ψ represents the network parameters to be optimized in the current iteration. This represents the value of Ψ when the objective function is found to be at its minimum. Let represent the reconstruction loss of the backdoor trigger based on the network parameter ψ, and It can be expressed in the form of the following formula (6); This indicates the loss that maximizes the gains from a backdoor. Inversely proportional to maximizing backdoor profits, maximizing backdoor profits means maximizing Δ(Z) t,Ψ,t); The sparse regularization operator representing the high-dimensional space of network parameters, also known as the sparse loss of network parameters, is used to promote... It exhibits sparsity characteristics (samples with backdoor triggers typically exhibit sparsity characteristics). The smaller the value, the more it means The sparser.

[0080]

[0081] In the above formula (6), Let Z be the expectation operator, representing the expectation of random variables t and Z. t Perform the expected value operation; Δ(Z) t ,Ψ,t) represents the difference between the velocity field fitted by the second neural network for normal latent space features at time t and the velocity field fitted by the first neural network to be trained for abnormal latent space features based on the current parameters Ψ used to describe the backdoor trigger, and this difference can be calculated by the above formula (4); max(0,∈1-Δ(Z t ,Ψ,t)) represents taking 0 and ∈1-Δ(Z) t The larger value in (,ψ,t); max(Δ(Z) t ,Ψ,t)-∈2) represents taking 0 and Δ(Z) t The larger value of ,Ψ,t)-∈2; ∈1 and ∈2 are both adjustable parameters, and ∈1≤∈2. ∈1 and ∈2 are used to limit the difference between the two velocity fields to a reasonable space.

[0082] By utilizing the backdoor trigger reconstruction loss, backdoor profit maximization loss, and sparsity loss of network parameter Ψ to construct the network parameter optimization problem of the first neural network to be trained, it is beneficial to consider the optimization and updating of network parameters from multiple dimensions such as reconstruction stability, backdoor attack effectiveness, and parameter sparsity. This helps to avoid the one-sidedness caused by considering the optimization and updating of network parameters from a single dimension, thereby improving the concealment and attack capability of the backdoor trigger infected by the successfully trained first neural network, and reducing the difficulty of solving the optimization problem.

[0083] S405. Determine whether the current condition for stopping iterative training is met. For example, determine whether the convergence degree of the network parameters of the first neural network to be trained meets the predetermined convergence condition. If the predetermined convergence condition is met, proceed to S406. If the predetermined convergence condition is not met, continue to determine whether the current iteration number exceeds the maximum iteration number. If the maximum iteration number has been exceeded, proceed to S407. If the maximum iteration number has not been exceeded, return to S401 and perform the next iteration training.

[0084] S406. The first neural network has been successfully trained. It should be noted that if the first flow matching model is a flow matching model that has not been infected by the backdoor trigger, the first neural network can also be trained successfully. Moreover, the backdoor trigger infection processing performed by the successfully trained first neural network in subsequent applications does not add the latent space features of the backdoor trigger to the normal latent space features. Therefore, the fourth neural network will not detect that the first flow matching model is a flow matching model infected by the backdoor trigger.

[0085] S407. The training process of the first neural network is completed. However, the training of the first neural network failed this time. The training process can be restarted by adjusting the normal sample set and adjusting the initial network parameters of the first neural network.

[0086] By providing the third latent space features of normal samples to the first neural network to be trained, the first neural network to be trained forms the fourth latent space features. The flow matching model is then used to perform velocity field fitting on the third and fourth latent space features to obtain the losses of the two velocity fields. By using the loss function to maximize the losses of both, the first neural network can learn the parameters corresponding to the backdoor triggers infected by the flow matching model during the training process. This allows for the acquisition of a batch of backdoor triggers that may exist in the flow matching model. This is beneficial for accurately providing the corresponding abnormal latent space features during the process of backdoor vulnerability repair in the flow matching model, the process of judging whether the first flow matching model is infected by backdoor triggers, the training process of the fourth neural network, and the security hardening process of the flow matching model.

[0087] (III) Determine the process of the first-order matching model being infected by the backdoor trigger.

[0088] When a user obtains a first-rate matching model, they are usually unaware whether it has been infected by a backdoor trigger. In this case, the user can use the following... Figure 5 The illustrated process is used to detect whether the first-line matching model has been infected by a backdoor trigger. It should be noted that the process of determining whether the first-line matching model has been infected by a backdoor trigger is typically executed after the first neural network has been successfully trained. Figure 5 The process shown mainly includes: S500, S501, S502, S503, and S504. The following is a description of... Figure 5 Each step is explained separately.

[0089] S500: Provide the fifth and sixth hidden space features of the normal samples to the second neural network to obtain the generation path of the first-flow matching model for the fifth and sixth hidden space features, the content information of the generated samples, and the data distribution of the generated samples.

[0090] Specifically, this disclosure can be derived from the above set {(Z0, Z1, ..., Z...} n At least one fifth latent space feature is selected from the set of normal samples, and the fifth latent space feature may be different from both the first latent space feature in S300 and the third latent space feature in S401. Alternatively, this disclosure may select multiple normal samples from the set of normal samples and encode each normal sample separately using the encoder and decoder in the first-stream matching model to obtain the fifth latent space feature of each normal sample, and each fifth latent space feature is a latent space feature that has not been infected by the backdoor trigger, i.e., a normal latent space feature.

[0091] After obtaining the fifth latent space features of each normal sample, this disclosure provides these features to a successfully trained first neural network. The first neural network then performs backdoor trigger infection processing on each fifth latent space feature to obtain the sixth latent space feature corresponding to each normal sample. When the first flow matching model is a backdoor-triggered flow matching model, the sixth latent space feature is a backdoor-triggered latent space feature, i.e., a backdoor latent space feature or an abnormal latent space feature. Conversely, when the first flow matching model is not a backdoor-triggered flow matching model, the sixth latent space feature is an un-backdoor-triggered latent space feature.

[0092] The fifth and sixth latent space features of each normal sample are provided to the second neural network in the first-stream matching model, thereby obtaining the generation path formed by the first-stream matching model for the fifth latent space feature, the content information of the generated sample and the data distribution of the generated sample, as well as the generation path formed for the sixth latent space feature, the content information of the generated sample and the data distribution of the generated sample.

[0093] S501. The generated path, the content information of the generated sample, and the data distribution of the generated sample are provided to the fourth neural network. The fourth neural network performs path trajectory mutation analysis, content deviation analysis, and data distribution difference analysis of the generated sample, and outputs the confidence level of the first-order matching model being infected by the backdoor trigger.

[0094] Specifically, for any normal sample, the fourth neural network can perform path trajectory mutation analysis on the generation path corresponding to the normal latent space features and the generation path corresponding to the abnormal latent space features of the normal sample, perform content deviation analysis on the content information of the generated sample corresponding to the normal latent space features and the content information of the generated sample corresponding to the abnormal latent space features of the normal sample, and perform data distribution difference analysis on the data distribution of the generated sample corresponding to the normal latent space features and the data distribution of the generated sample corresponding to the abnormal latent space features of the normal sample. Based on the path trajectory mutation, content deviation, and data distribution difference obtained from the analysis, a confidence score is formed for the first-flow matching model to be infected by the backdoor trigger, which represents the probability that the first-flow matching model is infected by the backdoor trigger.

[0095] S502. Use a preset threshold to judge the confidence level. If the confidence level meets the conditions set based on the preset threshold, proceed to S503. If the confidence level does not meet the conditions set based on the preset threshold, proceed to S504.

[0096] Specifically, if multiple normal samples are used, multiple confidence levels can be obtained. This disclosure can calculate the average of all obtained confidence levels and determine whether the average meets the conditions set based on a preset threshold, such as whether the average reaches the preset threshold. This disclosure can also perform a judgment on whether the conditions based on the preset threshold are met for each confidence level. If the number of confidence levels that meet the conditions reaches a certain requirement, proceed to S503; if the number of confidence levels that meet the conditions does not reach a certain requirement, proceed to S504.

[0097] S503. It is determined that the first-order matching model is infected by a backdoor trigger.

[0098] S504. Determine that the first-order matching model has not been infected by the backdoor trigger.

[0099] When the first-line matching model is infected by a backdoor trigger, the processing performed by the first-line matching model on normal latent space features and abnormal latent space features is different. Since path trajectory mutation, content deviation and data distribution differences can fully reflect the differences between the processing results of the first-line matching model on the two, it is helpful to quickly and accurately determine whether the first-line matching model has been infected by a backdoor trigger by using the fourth neural network to analyze path trajectory mutation, content deviation and data distribution differences.

[0100] (iv) Training process of the fourth neural network

[0101] Before users need to use the fourth neural network to determine whether their obtained first-order matching model has been infected by a backdoor trigger, the fourth neural network should be trained first. The training process for the fourth neural network can be as follows: Figure 6 As shown. Figure 6 The process shown mainly includes: S600, S601, S602, S603, and S604. The following is a description of... Figure 6 Each step is explained separately.

[0102] S600, Begin the training process for the fourth neural network.

[0103] Specifically, the network parameters of the fourth neural network to be trained can be initialized first. This initialization process can include setting the network parameters of the fourth neural network to be trained to initial values, etc.

[0104] S601 provides multiple input information for the fourth neural network to be trained.

[0105] The input information provided to the fourth neural network to be trained typically includes: multiple normal latent space features and latent space features obtained by subjecting each normal latent space feature to backdoor trigger infection (which can be called backdoor latent space features). For example, the backdoor latent space features formed using the first neural network successfully trained above.

[0106] S602. Based on the confidence levels output by the fourth neural network to be trained for each input information, form the ROC (Receiver Operating Characteristic) curve of the fourth neural network to be trained, and obtain the local AUC (Partial Area Under the ROC) index.

[0107] Specifically, the horizontal axis of the ROC curve represents the FPR (False Positive Rate) at different thresholds, and the FPR is inversely proportional to model performance; while the vertical axis represents the TPR (True Positive Rate) at different thresholds, and the TPR is directly proportional to model performance. The ROC curve can reflect the performance of the fourth neural network at different thresholds. A lower TPR and a higher FPR indicate that the fourth neural network is more likely to produce false negatives or false positives, and the model performance of the fourth neural network is poor. The local AUC index corresponds to a specific region in the ROC curve, and this specific region usually has the characteristics of high TPR and low FPR, which can better characterize the model performance in the key areas of the ROC curve.

[0108] S603. Calculate the loss based on the confidence level of the output of the fourth neural network to be trained and the local AUC index, and update the network parameters of the fourth neural network to be trained based on the result of the loss calculation.

[0109] Specifically, in the process of loss calculation, the local AUC index needs to be considered in order to optimize the performance of the fourth neural network on the local AUC index. Weighted loss function or surrogate loss can be used for loss calculation. This disclosure does not limit the specific form of the loss function.

[0110] S604. Determine whether training needs to continue, i.e., determine whether the current training iteration count has reached the predetermined number and whether the current local AUC metric has reached the predetermined requirement. If the current training iteration count has reached the predetermined number and the current local AUC metric has not reached the predetermined requirement, proceed to S605; if the current local AUC metric has reached the predetermined requirement, proceed to S606; if the current training iteration count has not reached the predetermined number and the current local AUC metric has not reached the predetermined requirement, return to S601.

[0111] S605. This training process has ended; the training of the fourth neural network has failed.

[0112] S606. This training process is complete. The fourth neural network has been successfully trained. The successfully trained fourth neural network can be used to verify whether the flow matching model has been infected by a backdoor trigger.

[0113] This disclosure introduces a local AUC metric for loss calculation during the training of the fourth neural network. This helps to maximize the TPR of the fourth neural network while ensuring that the FPR is low. This helps to avoid misjudging and missing the backdoor risk of the flow matching model caused by training with a single threshold. In turn, it helps to accurately identify whether the flow matching model is infected by a backdoor trigger.

[0114] (V) Security hardening process of flow matching model.

[0115] This disclosure allows the third neural network in a second-flow matching model that has patched the backdoor vulnerability to be used as a teacher model, and a student model to be set up for this teacher model. The network structure of the student model can be exactly the same as the network structure of the teacher model, or it can be different from the network structure of the teacher model. For example, the student model can have a more simplified network structure. This disclosure can provide the same input samples to the teacher model and the student model during training, and enable the student model to learn the velocity field generated by the teacher model for the input samples, so that the velocity field generated by the student model for the same input samples gradually approximates the velocity field generated by the teacher model for the input samples.

[0116] In one example, this disclosure can utilize knowledge distillation to train a student model. After successful training of the student model, it is used as a flow matching model for backdoor vulnerability remediation and security hardening.

[0117] During the training of the student model, the loss calculation should consider not only distillation loss and regularization loss, but also backdoor cleanup loss. Backdoor cleanup loss is mainly used to constrain the sensitivity of the student model to attack samples with backdoor triggers. That is, backdoor cleanup loss can make the student model insensitive to attack samples with backdoor triggers, thereby suppressing the occurrence of abnormal processing phenomena triggered by backdoor triggers. The loss function considering distillation loss, backdoor cleanup loss, and regularization loss in this disclosure can be expressed in the form of the following formula (7):

[0118]

[0119] In the above formula (7), This represents the model parameters of the student model obtained through optimization; This represents the model parameters for finding the student model that minimizes the value of the subsequent expression; γ1, γ2, and γ3 are adjustable tradeoff coefficients and hyperparameters, used to control the relative importance of the three loss terms in the overall loss. This represents the distillation loss, used to enable the student model to reproduce the velocity field of the teacher model in normal sample generation tasks, thus ensuring sample generation quality. It can be expressed using the following formula (8); This indicates the backdoor purification loss, and It can be expressed using the following formula (9); This represents the model parameter regularization loss, used to further constrain the smoothness of the model parameter space of the student model, and to remove backdoor features in the student model through parameter compression.

[0120]

[0121] In the above formula (8), This represents the expectation operator, used to calculate the expectation of random variables t, Z0, and Z1. This indicates that the Bregman divergence is used to measure the difference between vectors u and v. Used to measure teacher models and student model The difference between the velocity fields at time t when the input is (1-t)Z0+tZ1,t.

[0122]

[0123] In the above formula (9), This represents the expectation operator, used for random variables t, Z0, Z1, ... as well as Calculate the expected value; This indicates that the Bregman divergence is used to measure the difference between vectors u and v. Used to measure student models Given the inputs (1-t)Z0+tZ1,t and The difference between the velocity fields at time t should be as small as possible.

[0124] After patching the backdoor vulnerability in the neural network used to fit the velocity field in the flow matching model, although the backdoor generation path of the flow matching model for input samples with backdoor triggers can be aligned with the normal generation path, backdoor information still remains in the flow matching model. This residual backdoor information may be triggered in actual use, meaning the patched flow matching model may have security vulnerabilities. This disclosure utilizes a teacher-student model approach to train the student model. Since the teacher model does not exhibit any backdoor-related features during training, it helps prevent the student model from being influenced by backdoor knowledge during learning, thus avoiding the transmission of residual backdoor information from the teacher model to the student model and improving the security of the student model. By making the network structure of the student model the same as or different from that of the teacher model, users can select a flow matching model with a corresponding structure according to their actual situation. For example, based on the current computing power, a simpler model can be selected as the student model, making the implementation of the flow matching model more flexible. By using knowledge distillation to train the student model and adding backdoor cleanup loss to the loss calculation, the performance of the student model can be guaranteed while further suppressing the transfer of backdoor effects, thereby improving the security of the student model.

[0125] Exemplary electronic devices

[0126] The following is for reference. Figure 7 To describe an electronic device according to embodiments of the present disclosure. Figure 7 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. (As follows) Figure 7 As shown, the electronic device 71 includes one or more processors 711 and memory 712.

[0127] The processor 711 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 71 to perform desired functions.

[0128] The memory 712 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, and flash memory. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 711 may execute the program instructions to implement the backdoor attack defense methods for the flow matching model of the various embodiments of this disclosure described above, and / or other desired functions.

[0129] In one example, the electronic device 71 may further include an input device 713 and an output device 714, etc., these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown). Furthermore, the input device 713 may also include, for example, a keyboard, a mouse, etc. The output device 714 can output various information to the outside. The output device 714 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0130] Of course, for the sake of simplicity, Figure 7 Only some of the components of the electronic device 71 relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device 71 may include any other suitable components depending on the specific application.

[0131] Exemplary computer program products and computer-readable storage media

[0132] In addition to the methods and apparatus described above, embodiments of this disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps in the backdoor attack defense method for a flow-oriented matching model according to various embodiments of this disclosure as described in the "Exemplary Methods" section above.

[0133] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this disclosure. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program source code can be executed entirely on a user's computing device, partially on a user's device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. Furthermore, embodiments of this disclosure can also be computer-readable storage media storing computer program instructions that, when executed by a processor, cause the processor to perform the steps in the backdoor attack defense method based on the flow-oriented matching model according to various embodiments of this disclosure, as described in the "Exemplary Methods" section above. The computer-readable storage medium can be any combination of one or more readable media. A readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) may include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

Claims

1. A backdoor attack defense method for a flow-oriented matching model, characterized in that, The method comprises the following steps: The method further comprises a backdoor vulnerability repairing process of the flow matching model, and the backdoor vulnerability repairing process of the flow matching model comprises the following steps: The first hidden space feature of the normal sample is provided to the first neural network, and the first hidden space feature is subjected to backdoor trigger infection processing by the first neural network to obtain a second hidden space feature; The first hidden space feature is provided to a second neural network in a first flow matching model for fitting a velocity field of an initial data distribution and a target data distribution to obtain a first velocity field, and the second hidden space feature is provided to a third neural network in a second flow matching model for fitting a velocity field of an initial data distribution and a target data distribution to obtain a second velocity field; wherein the first flow matching model is a flow matching model infected by a backdoor trigger, and the first flow matching model and the second flow matching model are reciprocal copy models; The network parameters of the third neural network are adjusted according to the consistency constraint of the first velocity field and the second velocity field; A flow matching model with repaired backdoor vulnerability is obtained according to the adjusted third neural network.

2. The method of claim 1, wherein, The method further comprises a training process of the first neural network, and the training process of the first neural network comprises the following steps: The third hidden space feature of the normal sample is provided to the first neural network to be trained, and the third hidden space feature is subjected to backdoor trigger hidden space feature infection processing by the first neural network to be trained to obtain a fourth hidden space feature; The third hidden space feature and the fourth hidden space feature are respectively provided as inputs to the second neural network, and the third hidden space feature and the fourth hidden space feature are respectively subjected to velocity field fitting processing by the second neural network to obtain a third velocity field and a fourth velocity field; Loss calculation is performed according to the difference between the third velocity field and the fourth velocity field, and the network parameters of the first neural network to be trained are updated using the result of the loss calculation; The above steps are repeated until the training process is completed.

3. The method of claim 2, wherein, The network parameters of the first neural network to be trained comprise parameters for describing the characteristics of the backdoor trigger; The parameters for describing the characteristics of the backdoor trigger comprise at least one of parameters for describing the position of the backdoor trigger, parameters for describing the content of the backdoor trigger, parameters for describing the size of the backdoor trigger, and parameters for describing the shape of the backdoor trigger.

4. The method according to claim 2 or 3, characterized in that, The loss calculation according to the difference between the third velocity field and the fourth velocity field, and the updating of the network parameters of the first neural network to be trained using the result of the loss calculation, comprise the following steps: An optimization problem of the network parameters of the first neural network to be trained is constructed according to a backdoor trigger reconstruction loss, a backdoor benefit maximization loss, and a network parameter sparsity loss; The network parameters of the first neural network to be trained are updated according to the solution result of the optimization problem of the network parameters.

5. The method according to claim 1 or 2 or 3, characterized in that, The method further comprises a process of judging that the first flow matching model is infected by a backdoor trigger, and the process of judging that the first flow matching model is infected by a backdoor trigger comprises the following steps: The fifth hidden space feature and the sixth hidden space feature of the normal sample are respectively provided to the second neural network, and the generation path, the content information of the generated sample, and the data distribution of the generated sample of the first flow matching model are obtained for the fifth hidden space feature and the sixth hidden space feature respectively; wherein the sixth hidden space feature is a hidden space feature after the fifth hidden space feature is processed by a backdoor trigger infection; The generation path, the content information of the generated sample, and the data distribution of the generated sample are provided to the fourth neural network, path trajectory mutation analysis, content deviation analysis, and data distribution difference analysis of the generated sample are performed by the fourth neural network, and the confidence of the first flow matching model being infected by the backdoor trigger is output; Whether the first flow matching model is infected by the backdoor trigger is determined according to the confidence.

6. The method according to claim 1 or 2 or 3, characterized in that, The method further includes a process of determining whether the first flow matching model is infected by the backdoor trigger, and the process of determining whether the first flow matching model is infected by the backdoor trigger includes: The fifth hidden space feature and the sixth hidden space feature of the normal sample are respectively provided to the second neural network, and the generation path, the content information of the generated sample, and the data distribution of the generated sample of the first flow matching model are obtained for the fifth hidden space feature and the sixth hidden space feature respectively; wherein the sixth hidden space feature is a hidden space feature after the fifth hidden space feature is processed by a backdoor trigger infection; According to the generation path, the content information of the generated sample, and the data distribution of the generated sample corresponding to the fifth hidden space feature and the sixth hidden space feature respectively, path trajectory mutation information, content deviation information, and data distribution difference information of the generated sample are determined; The path trajectory mutation information, the content deviation information, and the data distribution difference information of the generated sample are provided to the fourth neural network, and the confidence of the first flow matching model being infected by the backdoor trigger is output by the fourth neural network according to the path trajectory mutation information, the content deviation information, and the data distribution difference information of the generated sample; Whether the first flow matching model is infected by the backdoor trigger is determined according to the confidence.

7. The method according to claim 5 or 6, characterized in that, The method further includes a training process of the fourth neural network, and the training process of the fourth neural network includes: According to the confidence output by the to-be-trained fourth neural network, a receiver operating characteristic (ROC) curve of the to-be-trained fourth neural network is formed; When a local area under the curve (AUC) index under the ROC curve meets a predetermined condition, the training of the fourth neural network is successfully completed.

8. The method according to claim 1 or 2 or 3, characterized in that, The method further includes a flow matching model security reinforcement process, and the flow matching model security reinforcement process includes: The third neural network in the flow matching model in which the backdoor vulnerability is repaired is used as a teacher model, and the student model is trained by using the teacher model, so that the student model learns the velocity field generated by the teacher model for the input sample; The successfully trained student model is used as the third neural network in the flow matching model in which the backdoor vulnerability is repaired and the security is reinforced.

9. The method of claim 8, wherein, The training of the student model by using the teacher model includes: training the student model in a manner of knowledge distillation; and the network structure of the student model is the same as that of the teacher model; or the network structure of the student model is not the same as that of the teacher model.

10. The method of claim 8, wherein, The training of the student model in the manner of knowledge distillation comprises: updating the model parameters of the student model according to the distillation loss, the backdoor purification loss and the regularization loss; wherein the backdoor purification loss is a loss set based on the difference between the velocity fields formed by the student model for normal samples and samples infected by the backdoor trigger. 11.A computer readable storage medium, the storage medium storing a computer program, the computer program being used to execute the method of any one of claims 1-9. 12.An electronic device, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the method of any one of claims 1-9.

Images