Deep neural network-oriented sample hierarchical backdoor implantation method and device

Abstract

The invention provides a deep neural network-oriented sample hierarchical backdoor implantation method and device. The method comprises the steps of inserting an outlet into each intermediate layer in a target deep neural network to obtain a dynamic deep neural network; inputting a data set under a specified image category into the dynamic deep neural network, dividing the data set into a soft sample data set and a hard sample data set based on an output result when a preset early leaving condition is met, and adding corresponding triggers into the divided samples respectively, a trigger training data set is obtained, and a trigger training strategy is combined to carry out iterative training on a trigger to obtain a target trigger; adding a corresponding target trigger in the original soft sample and the hard sample, obtaining a network training data set in combination with the original training sample set, carrying out iterative training on the dynamic deep neural network in combination with a preset network training strategy to obtain a target dynamic deep neural network, and carrying out conversion to obtain a backdoor deep neural network; according to the invention, the robustness and stability of backdoor implantation can be improved.

Description

Technical Field

[0001] This invention relates to the field of deep learning security technology, and in particular to a method and apparatus for implanting backdoors in sample layering for deep neural networks. Background Technology

[0002] The rapid development of machine learning technologies, represented by deep learning, has brought unprecedented performance improvements to pattern recognition tasks in the field of computer vision. However, it has also introduced a series of critical security vulnerabilities, among which backdoor attacks are particularly serious. In a backdoor attack, attackers implant malicious backdoors into deep neural network models during training. These backdoors are activated by pre-designed trigger patterns during the model's inference phase, causing the model to give incorrect predictions as expected by the attacker. Data poisoning is a typical method of injecting backdoors into deep neural networks. Attackers add triggers and bind target labels to benign samples, constructing a poisoned dataset mixed with clean data during the training phase, hoping to change the prediction results of the poisoned samples during the inference phase.

[0003] Existing backdoor attacks include sample-based attacks. Sample-based attacks generate unique triggers for each sample by designing diverse transformation functions, such as warp transformations, generators, encoders, pixel perturbations, etc. This type of attack allows attackers to flexibly specify arbitrary target labels during the model inference stage, and its trigger patterns can be dynamically generated based on the features of the input samples, thus possessing the stealth characteristic of evading backdoor detection.

[0004] However, sample-based attack methods rely on specific input samples. While enhancing the stealth of backdoor attacks, their triggering mechanisms reveal critical flaws in the evaluation of backdoor defense methods, particularly when evaluating backdoor mitigation techniques, where the attack effectiveness exhibits significant instability. Since backdoor mitigation techniques can utilize clean data to weaken the originally fragile correlation between triggers and target labels, effectively eliminating or mitigating the backdoor effect, sample-based attack methods suffer from insufficient robustness and stability when facing such techniques. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a sample-layered backdoor implantation method and apparatus for deep neural networks, to eliminate or improve one or more defects existing in the prior art. It can solve the problem of insufficient robustness and stability of sample-based attack methods when facing backdoor mitigation techniques.

[0006] One aspect of the present invention provides a sample-layered backdoor implantation method for deep neural networks, the method comprising the following steps:

[0007] The specified image dataset corresponding to the specified image category in the original training sample set is input into a pre-constructed dynamic deep neural network with an early exit mechanism. Based on the set early exit conditions, the sample stratification result is output, dividing the specified image dataset into a soft sample dataset and a hard sample dataset. The dynamic deep neural network is obtained by inserting an early exit point into each intermediate layer of the target deep neural network and assigning exit weights.

[0008] Add soft triggers to samples in the soft sample dataset and hard triggers to samples in the hard sample dataset to obtain the trigger training dataset.

[0009] The trigger training dataset is input into a dynamic deep neural network, and the soft trigger and hard trigger are iteratively trained in combination with a preset trigger training strategy to obtain the target soft trigger and the target hard trigger. The preset trigger training strategy includes a preset loss term and preset constraints. The preset loss term includes the trigger loss for the trigger, and the preset constraints include the upper limit of the amplitude of the trigger under the infinite norm.

[0010] Add target soft triggers to the original samples in the soft sample dataset, add target hard triggers to the original samples in the hard sample dataset, and combine them with the original training sample set to obtain the training dataset for the corresponding dynamic deep neural network.

[0011] By combining the network training dataset with a preset network training strategy, the dynamic deep neural network is iteratively trained to obtain the target dynamic deep neural network. When loading model parameters, the loading of weights corresponding to early exits is excluded to obtain the backdoor deep neural network. The preset network training strategy includes a multi-exit loss optimization term.

[0012] In some embodiments of the present invention, the triggering loss includes a first potential activation loss corresponding to a soft trigger, a second potential activation loss corresponding to a hard trigger, and an uncertainty loss corresponding to a hard trigger; the preset constraint condition includes a first constraint condition corresponding to a soft trigger and a second constraint condition corresponding to a hard trigger.

[0013] The first latent activation loss is used to reduce the activation difference between the original samples and the samples after adding soft triggers in the intermediate layer of the soft sample dataset, and to ensure that the soft triggers satisfy the first constraint condition.

[0014] The second latent activation loss is used to reduce the activation difference between the original samples and the samples after adding hard triggers in the intermediate layer of the hard sample dataset, and to ensure that the hard triggers satisfy the second constraint condition.

[0015] Uncertainty loss is used to reduce the difference in activation distribution between the original samples and the samples after adding hard triggers in the intermediate layer of the hard sample dataset, and to ensure that the hard triggers satisfy the second constraint condition.

[0016] In some embodiments of the present invention, the preset trigger training strategy is expressed as follows:

[0017]

[0018] st‖t s || ∞ ≤δ s ,‖t h || ∞ ≤δ h

[0019] In the formula, This represents the first potential activation loss; This represents the second potential activation loss; Indicates loss due to uncertainty; t s Indicates a soft trigger; x s t represents a sample in a soft-sample dataset; h Indicates a hard trigger; x h Represents a sample in the hard sample dataset; α represents the hyperparameter used to adjust the mixing weights of the hard trigger; ||t s || ∞ δ represents the infinite norm corresponding to the soft trigger; s ‖t is a constant representing the upper limit of the infinity norm corresponding to the soft trigger; h || ∞ δ represents the infinite norm corresponding to the hard trigger; h is a constant representing the upper limit of the infinite norm corresponding to the hard trigger.

[0020] In some embodiments of the present invention, a trigger training dataset is input into a dynamic deep neural network, and soft triggers and hard triggers are iteratively trained in conjunction with a preset trigger training strategy to obtain target soft triggers and target hard triggers, including:

[0021] Based on the loss result of the trigger loss, gradient updates are performed on soft triggers and hard triggers;

[0022] Numerical pruning is performed on the gradient-updated soft triggers and gradient-updated hard triggers so that the value of each element in the pruned soft triggers and hard triggers is within a preset range; the above steps are repeated until a preset number of iterations are reached to obtain the target soft triggers and target hard triggers.

[0023] In some embodiments of the present invention, the initial soft trigger and the initial hard trigger are randomly selected from a uniform distribution within a preset interval.

[0024] In some embodiments of the present invention, the multi-exit loss optimization term includes a first export loss and a second export loss;

[0025] The first early termination loss is used to reduce the difference between the output of each exit and the real sample label corresponding to the original training sample when the input of the dynamic neural network model is the original training sample set.

[0026] The second early termination loss is used to reduce the difference between the output of each exit and the sample label corresponding to the specified image category when the input of the dynamic neural network model is a sample with a target hard trigger or a target soft trigger.

[0027] In some embodiments of the present invention, the preset network training strategy is expressed as follows:

[0028]

[0029] In the formula, K represents the total number of exports; i represents the i-th export; Represents cross-entropy loss; x o θ′ represents a sample in the original training sample set. dy This represents the network parameters corresponding to a dynamic deep neural network; y o x represents o The corresponding sample label; x′ represents a sample with a target hard trigger added or a sample with a target soft trigger added; y t F′ represents the sample label corresponding to the specified image category. i (x o ;θ′ dy ) indicates that when the input is x o The network parameters are θ′ dy In the case of F′, the output of the i-th exit in a dynamic deep neural network; i (x′;θ′ dy ) indicates that the input is x′ and the network parameters are θ′. dy In the case of , the output of the i-th exit in the dynamic deep neural network; This indicates the loss from the primary export; This indicates a loss in the second export sector.

[0030] In some embodiments of the present invention, the preset early exit condition includes a threshold condition for determining whether the image activation value output by the intermediate layer meets a set threshold or an exit sequence condition for determining whether the early exit exit position meets a set sequence number.

[0031] The specified image dataset corresponding to a specified image category in the original training sample set is input into a pre-constructed dynamic deep neural network with an early termination mechanism. Based on the set early termination conditions, the network outputs sample stratification results, dividing the specified image dataset into a soft sample dataset and a hard sample dataset, including:

[0032] Input sample images from a specified image dataset into a dynamic deep neural network to obtain the output results of the dynamic deep neural network at a specified early exit point; the specified exit point refers to an early exit point whose ordinal number is less than or equal to a set ordinal number; the output results include the image activation values ​​that correspond one-to-one between the sample images and each image category.

[0033] The image activation values ​​in the output are compared with the set threshold. If there are image activation values ​​that are greater than or equal to the set threshold, the preset early termination condition is met, and the sample image is assigned to the soft sample dataset.

[0034] Another aspect of the present invention provides a sample-layered backdoor implantation device for deep neural networks, including a processor, a memory, and a computer program / instructions stored in the memory. The processor is used to execute the computer program / instructions. When the computer program / instructions are executed, the device implements the steps of the sample-layered backdoor implantation method for deep neural networks as described above.

[0035] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the sample layering backdoor implantation method for deep neural networks as described above.

[0036] The present invention provides a sample-layered backdoor implantation method and apparatus for deep neural networks, which addresses the lack of robustness and stability of sample-based attack methods when facing backdoor mitigation techniques. Based on a specified image dataset corresponding to a specified image category, a sample layering strategy is proposed. The specified image dataset is divided into a soft sample dataset and a hard sample dataset according to a preset early termination threshold. The soft and hard sample datasets represent different triggering difficulties and feature distributions, and corresponding triggers, including soft and hard triggers, are trained separately. Soft triggers can be quickly activated in shallow networks, while hard triggers rely on deeper semantic features, forming a "multi-layered defensive" backdoor structure. This allows for better matching of the feature spaces of different samples, improving the adaptability of triggers to different input samples and enhancing the robustness of backdoor implantation. Simultaneously, through the sample layering design, the target soft trigger and target hard trigger act on different levels of the feature space, making it difficult for backdoor mitigation techniques to destroy all triggering paths at once. Even if some features are destroyed by backdoor mitigation techniques, other triggers may still remain effective, thereby improving the stability of backdoor implantation.

[0037] In addition, during the iteration process of soft triggers and hard triggers, corresponding potential activation losses are set for soft triggers and hard triggers respectively, including constraint constants set for soft triggers and hard triggers respectively, to limit the upper limit of the infinite norm corresponding to the triggers, and to restrict the value of each element in the hard trigger to a preset range to improve the concealment of the triggers, thereby further improving the concealment of backdoor implantation.

[0038] In addition, optimizing the trigger design by implanting a backdoor in a dynamic deep neural network with an early exit mechanism and fusing potential image activation values ​​from multiple exit outputs helps to improve the concealment of the backdoor implantation.

[0039] Furthermore, during the backdoor implantation process, the backdoor is first injected during the training phase of the dynamic deep neural network. Then, the weights of the model carrying the backdoor are transferred to a regular deep neural network model with the same architecture, thereby further enhancing the stealth of the backdoor implantation. This method can not only launch effective attacks on two different architectures of models, dynamic deep neural networks and static deep neural networks, but also shows wider applicability compared to traditional backdoor implantation methods, providing a more practical reference for the research and evaluation of backdoor defense mechanisms.

[0040] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0041] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0042] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0043] Figure 1 This is a flowchart of a sample layering backdoor implantation method for deep neural networks provided in an embodiment of the present invention.

[0044] Figure 2 A flowchart of a sample layering backdoor implantation method for deep neural networks provided in another embodiment of the present invention.

[0045] Figure 3 A block diagram of a sample layering backdoor implantation device for deep neural networks provided in another embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0047] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0048] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0049] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0050] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0051] The following section provides a detailed description of the sample-layered backdoor implantation method for deep neural networks provided in this application.

[0052] like Figure 1 As shown, embodiments of this application provide a sample-layered backdoor implantation method for deep neural networks. The implementation of this method relies on a computer program that can run on computer devices such as smartphones, tablets, and personal computers, or on a server. This embodiment does not limit the operating entity of the method. The method includes at least steps S101 to S105:

[0053] Step S101: Input the specified image dataset corresponding to the specified image category in the original training sample set into the pre-constructed dynamic deep neural network with an early exit mechanism, and output the sample stratification result based on the set early exit conditions, dividing the specified image dataset into a soft sample dataset and a hard sample dataset.

[0054] Dynamic deep neural networks (DyNNs) are deep neural networks (DNNs) with an early stopping mechanism. They are created by inserting an early stopping point into each intermediate layer of the target deep neural network and assigning exit weights, then adjusting the network using the original training sample set corresponding to the target deep neural network. Unlike traditional static deep neural network models, dynamic deep neural networks, when early stopping conditions are set, can improve inference efficiency based on input complexity (such as dynamic shallow / deep networks, branching networks, and adaptive networks).

[0055] The original training sample set refers to the sample dataset used to train the target deep neural network; the early exit mechanism refers to the mechanism that terminates the subsequent calculations and outputs the prediction results in the current intermediate layer during the neural network inference process based on exit conditions such as the feature representation quality or classification confidence of the input samples.

[0056] This embodiment uses a typical image classification task (x, y) ~ D as an example for illustration. Here, x represents a sample image, and x ∈ R. d R d Let represent a d-dimensional space; y represents the sample label, and y∈{1,2,…,N}; (x,y)~D represents the distribution of the sample (x,y) from the dataset D.

[0057] The goal of this image classification task is to train a deep neural network model F, where model F corresponds to the model parameters. in, The loss function is represented, including but not limited to cross-entropy loss or mean squared error loss.

[0058] By adding extra early exits in the intermediate layers inside model F, making the total number of exits (including the final output exit) K (K is an integer greater than or equal to 2), and with the help of fine-tuning the dataset D, the deep neural network model F is transformed into a dynamic deep neural network with an early exit mechanism.

[0059] The output of each exit of a dynamic deep neural network is represented as F. i (i≤K). For any sample image x∈R d F i (x)∈R N This represents the image activation value corresponding to category 1 to N when the input is a sample image x.

[0060] In some embodiments of the present invention, the early exit exit is implemented by one or more combinations of the following methods:

[0061] The first method is based on confidence thresholds.

[0062] Specifically, the output point of each intermediate layer in a dynamic deep neural network is considered as a potential early termination point, and the output F of intermediate layer i is... i The confidence level is converted through the softmax function. If the probability of a certain category among categories 1 to N is greater than or equal to the preset confidence threshold, it is considered that the dynamic deep neural network has sufficient confidence in the classification prediction of the current input sample image, allowing the inference process to be terminated early in the current intermediate layer of the network and the prediction result to be output.

[0063] The second approach is based on feature differences.

[0064] Specifically, the decision to exit early is made by comparing the similarity or degree of change in the feature representations between different intermediate layers, in order to effectively assess whether the information of the current intermediate layer is sufficient for prediction decisions. For example, the difference between the output features of the current intermediate layer and the output features of the previous layers is calculated using a preset similarity algorithm (including L2 distance algorithm, cosine similarity algorithm, etc.). If the difference is less than or equal to a preset difference threshold, the output features of the current intermediate layer can be considered to be sufficiently stable, and the intermediate layer can be exited early.

[0065] The third approach is based on the variation of loss in different intermediate layers.

[0066] Specifically, different loss functions are set for different intermediate layers, and the trend of these losses is used to determine whether early exit is possible. For example, if the loss stops decreasing significantly from a certain intermediate layer onwards, early exit at that intermediate layer is possible.

[0067] In practice, the early exit threshold may also include a lightweight classifier for classifying the feature representations of the current intermediate layer. This embodiment does not limit the implementation method of the early exit threshold.

[0068] The target deep neural network refers to the original deep neural network that requires backdoor implantation, including at least one intermediate layer. The intermediate layer includes any neural network layer located between the input and output layers of the original deep neural network, used for non-linear transformation and high-dimensional representation learning of the input features, including but not limited to convolutional layers, fully connected layers, or attention layers.

[0069] In traditional backdoor implantation setups, a malicious training process is used to obtain the backdoor neural network model F′ corresponding to the neural network model F, learning clean samples (x,y)~D. c and poisoned samples (x′, y t The mapping relationship between D and D induces predictions for images of any category other than the target category.

[0070] Among them, D c Let F represent the clean, original training sample set corresponding to model F; x represents a sample image, and x∈R d R d Let represent a d-dimensional space; y represent the sample label, and y∈{1,2,…,N}; (x,y)~D c This indicates that the sample (x, y) comes from dataset D. c The distribution of ; x′ represents the tampered sample image, y t Represents the label corresponding to the target category image; (x′, y t )~D′ represents the sample (x′,y t The distribution of the poisoning dataset D′.

[0071] Specifically, the paradigm of traditional backdoor attacks is represented by the following formula:

[0072] Where (x,y)∈D c ,(x′,y t )∈D′

[0073] In the formula, F′ represents the backdoor neural network model; θ′ represents the model parameters of the backdoor neural network model F′; and x represents the dataset D. c Sample images in; The loss function is represented by x′; the manipulated sample image in dataset D′ is represented by y. t D represents the label corresponding to the target category image; c Let F represent the clean, original training sample set corresponding to model F; D′ represents the dataset consisting of the manipulated sample images x′, with the corresponding image labels being the specified image categories y. t ; Used to ensure that the backdoor model F′ is in dataset D c The performance in the model is similar to that of model F; This demonstrates the backdoor attack behavior. When the input sample image x′ is given, the backdoor model will output the label y corresponding to the target category image. t Wherein, the sample image x′ is derived from the original training sample set D. c The sample image x and the trigger t of the subset are transformed and can be represented as x′=x+t.

[0074] However, the triggering mechanism of the aforementioned sample-based backdoor implantation methods has a critical flaw in the evaluation of backdoor defense methods, especially in the evaluation of backdoor mitigation techniques, where it exhibits instability. Backdoor mitigation techniques utilize clean data to corrupt triggers t and labels y. t The fragile connections between them ultimately eliminate and mitigate the backdoor effect. The vulnerability exhibited by sample-based attacks stems from an inherent balance: while sample-based triggers enhance the stealth of backdoor implantation, their reliance on samples weakens their robustness to backdoor defense methods, especially backdoor mitigation techniques.

[0075] Based on this, this embodiment proposes a sample stratification strategy, which divides a specified image dataset under a specified image category into two categories: soft sample dataset and hard sample dataset, and formulates corresponding triggers for each category (including soft triggers for soft sample datasets and hard triggers for hard sample datasets). The robustness of backdoor implantation is enhanced through sample stratification design.

[0076] The specified image category refers to a pre-selected victim category. One image category can be chosen from all available image categories as the specified category, and an image from a category other than the specified category can be selected as the target category. Poisoned images are generated by adding soft or hard triggers to sample images within the specified image category.

[0077] When the poisoned image received by the image classification model is generated by adding triggers to samples in the specified image category, the model will activate the backdoor mechanism and output the image label corresponding to the set target category image, thereby realizing the manipulation of the model's prediction results.

[0078] When the poisoned image received by the model is generated by adding triggers to images of other categories besides the specified image category, the model can still output the original correct image label and show normal classification performance.

[0079] For example, taking image categories 1, 2, and 3 as an example; taking category 1 as the victim category and category 3 as the target category; tampering with images under category 1 so that after inputting the tampered image into the image classification model, the image label output by the model is the label corresponding to category 3; tampering with images under category 2 so that after inputting the tampered image into the image classification model, the image label output by the model is the label corresponding to category 2.

[0080] Specifically, the backdoor implantation paradigm in this embodiment is expressed by the following formula:

[0081] Where (x) o ,y o)∈D c ∪D′ o , (x′ v ,y t )∈D′ v

[0082] In the formula, F′ represents the backdoor neural network model; θ′ represents the model parameters of the backdoor neural network model F′; D′ o This represents a poisoned image dataset consisting of images from categories other than the specified image category, to which triggers are added; D c x represents the clean, original training sample set corresponding to model F; o Indicates that it comes from dataset D c or D′ o Images from the dataset; y o Indicates that it comes from dataset D c or D′ o The true labels of the images in the dataset, x′ v Represents the poisoned image dataset D′ v The image in, x′ v Based on sample image x v The poisoning images produced, sample image x v This represents the specified image dataset D corresponding to the specified image category. v Clean image in; y t The label represents the category of the target image.

[0083] In this embodiment, the specified image dataset is divided into a sample dataset and a hard sample dataset by using a preset early termination condition and the output result of the specified image dataset after inputting it into a dynamic deep neural network.

[0084] Among them, the preset early exit condition refers to a set of rules or threshold standards that are set in advance to determine whether a sample image can exit early in the intermediate layer of a dynamic deep neural network.

[0085] In some embodiments of the present invention, the preset early exit condition includes a threshold condition for determining whether the image activation value output by the intermediate layer meets a set threshold, or an exit sequence condition for determining whether the early exit exit position meets a set sequence number.

[0086] The threshold condition includes a set threshold H for measuring the maximum activation value of the early exit point; the exit ordinal condition includes a set ordinal l for distinguishing between shallow and deep early exit points in the dynamic neural network.

[0087] In some embodiments of the present invention, a specified image dataset corresponding to a specified image category is input into a dynamic deep neural network. For early exits in the network whose exit ordinal number is less than or equal to a set ordinal number, their output is compared with a set threshold. If any image activation value in the output is greater than the set threshold, the sample image is classified into the soft sample dataset.

[0088] Specifically, a pre-constructed dynamic deep neural network with an early termination mechanism is input into a specified image dataset corresponding to a specified image category in the original training sample set. Based on the set early termination conditions, the sample stratification results are output, dividing the specified image dataset into a soft sample dataset and a hard sample dataset. This includes: inputting sample images from the specified image dataset into the dynamic deep neural network to obtain the output results of the specified early termination exit in the dynamic deep neural network; the specified exit refers to an early termination exit with an ordinal number less than or equal to a set ordinal number; the output results include the image activation values ​​corresponding one-to-one between the sample images and each image category; comparing the image activation values ​​in the output results with a set threshold, and if there are image activation values ​​greater than or equal to the set threshold, it is determined that the preset early termination conditions are met, and the sample images are classified into the soft sample dataset.

[0089] For a given image dataset D of a specified image type v Soft sample dataset D s This can be expressed by the following formula:

[0090] D s ={x s |maxF i (x v )≥H,i≤l,x s ∈D v}

[0091] In the formula, x v Represents sample image data D v Sample images in; maxF i (x v ) represents the maximum image activation value in the output result corresponding to the i-th exit; H represents the set threshold; l represents the set ordinal number; x s This represents the sample images in the soft sample dataset.

[0092] The sample image data D v Images other than the soft samples are assigned to the hard sample dataset, D. h This can be expressed by the following formula:

[0093] D h ={x h |D v -D s ,xh ∈D v}

[0094] In the formula, D v Represents a specified image dataset under a specified image type; D s Represents a soft sample dataset; x h This represents the sample images in the hard sample dataset.

[0095] In other embodiments of the present invention, a specified image dataset corresponding to a specified image category is input into a dynamic deep neural network. After the intermediate layer of the network generates an output, it is compared with a set threshold. If any image activation value in the output is greater than the set threshold, the exit ordinal number corresponding to the early exit point that generated the output is further compared with a set ordinal number. If the exit ordinal number is less than or equal to the set ordinal number, the sample image is classified into the soft sample dataset.

[0096] Specifically, the specified image dataset corresponding to the target deep neural network under the specified image category is input into the dynamic deep neural network. Based on the output result of the dynamic deep neural network when the preset early termination condition is met, the specified image dataset is divided into a soft sample dataset and a hard sample dataset. This includes: inputting sample images from the specified image dataset into the dynamic deep neural network; after the intermediate layer of the dynamic deep neural network generates the output result, the output result is compared with a set threshold; if there are activation values ​​in the output image that are greater than the set threshold, the exit ordinal number of the early termination exit corresponding to the output result is compared with a set ordinal number; if it is less than or equal to the set ordinal number, the preset early termination condition is met, and the sample image is classified into the soft sample dataset.

[0097] In practice, the preset early termination condition can also include other conditions, such as the similarity or degree of change of feature representations between different intermediate layers. If the difference between the output feature of the current intermediate layer and the output features of the previous few layers is less than or equal to a preset difference threshold, the output feature of the current intermediate layer can be considered sufficiently stable, and the layer can be terminated early. Alternatively, it can also include an intermediate layer loss change condition; when the loss of a certain intermediate layer no longer decreases significantly, the layer can be terminated early. This embodiment does not limit the implementation method of the preset early termination condition.

[0098] Based on dynamic deep neural networks and preset early termination conditions, a specified image dataset is divided into soft sample datasets and hard sample datasets. Specific triggers are designed to match the soft sample dataset and the hard sample dataset, including soft triggers for the soft sample dataset and hard triggers for the hard sample dataset.

[0099] Step S102: Add soft triggers to samples in the soft sample dataset and hard triggers to samples in the hard sample dataset to obtain the trigger training dataset.

[0100] In some embodiments of the present invention, the initial soft triggers and the initial hard triggers are uniformly distributed from a preset interval (e.g., It was randomly selected from ).

[0101] In practice, features or patterns can also be extracted from the training data as triggers. For example, high-frequency perturbation patterns can be extracted from clean samples as soft triggers, and structured features (such as textures or edges) can be extracted as hard triggers. This embodiment does not limit the initialization method of soft and hard triggers.

[0102] Step S103: Input the trigger training dataset into the dynamic deep neural network, and iteratively train the soft trigger and hard trigger using a preset trigger training strategy to obtain the target soft trigger and target hard trigger.

[0103] The preset trigger training strategy includes a preset loss term and preset constraints. The preset loss term includes the trigger loss for the trigger, and the preset constraints include the upper limit of the trigger's amplitude under the infinite norm.

[0104] Specifically, the triggering loss includes the first potential activation loss corresponding to the soft trigger, the second potential activation loss corresponding to the hard trigger, and the uncertainty loss corresponding to the hard trigger; the preset constraint conditions include the first constraint condition corresponding to the soft trigger and the second constraint condition corresponding to the hard trigger.

[0105] Specifically, the first latent activation loss is used to reduce the activation difference between the original samples and the samples after adding soft triggers in the soft sample dataset at the intermediate layer, and to ensure that the soft triggers satisfy the first constraint condition. The second latent activation loss is used to reduce the activation difference between the original samples and the samples after adding hard triggers in the hard sample dataset at the intermediate layer, and to ensure that the hard triggers satisfy the second constraint condition.

[0106] Significant differences in activation patterns between hierarchical samples require special handling, especially in shallow networks where samples with hard triggers exhibit drastically different behavioral characteristics compared to those with soft triggers. To maintain the hierarchical characteristics of samples in shallow layers while ensuring activation consistency between samples with triggers and clean samples, this embodiment introduces uncertainty loss to optimize hard triggers.

[0107] Specifically, the uncertainty loss is used to reduce the difference in activation distribution between the original samples and the samples after adding hard triggers in the intermediate layer of the hard sample dataset, and to ensure that the hard triggers satisfy the second constraint condition. The preset trigger training strategy is expressed by the following formula:

[0108]

[0109] st||t s || ∞ ≤δ s , ||t h || ∞ ≤δ h

[0110] In the formula, This represents the first potential activation loss; This represents the second potential activation loss; Indicates loss due to uncertainty; t s Indicates a soft trigger; x s t represents a sample in a soft-sample dataset; h Indicates a hard trigger; x h Represents a sample in the hard sample dataset; α represents the hyperparameter used to adjust the mixing weights of the hard trigger; ||t s || ∞ δ represents the infinite norm corresponding to the soft trigger; s ‖t is a constant representing the upper limit of the infinity norm corresponding to the soft trigger; h || ∞ δ represents the infinite norm corresponding to the hard trigger; h is a constant representing the upper limit of the infinite norm corresponding to the hard trigger.

[0111] Among them, the first potential activation loss The optimization is expressed by the following formula:

[0112]

[0113] st‖t s || ∞ ≤δ s

[0114] In the formula, σ represents the softmax function; K represents the total number of exits; i represents the i-th exit; λ i The hyperparameter representing the loss weight of the i-th exit; Denotes the L2 norm; ||t s || ∞ δ represents the infinite norm corresponding to the soft trigger; s F is a constant representing the upper limit of the infinity norm corresponding to the soft trigger, used to enhance the concealment of the soft trigger; i (x s ) indicates that the input is x s The output result of the i-th output; F i (x s+t s ) indicates that the input is x s +t s The output result of the i-th exit.

[0115] First potential activation loss The optimization is expressed by the following formula:

[0116]

[0117] st‖t h || ∞ ≤δ h

[0118] In the formula, σ represents the softmax function; K represents the total number of exits; i represents the i-th exit; λ i The hyperparameter representing the loss weight of the i-th exit; Denotes the L2 norm; ||t h || ∞ δ represents the infinite norm corresponding to the soft trigger; h F is a constant representing the upper limit of the infinity norm corresponding to the hard trigger, used to enhance the concealment of the hard trigger; i (x h ) indicates that the input is x h The output result of the i-th output; F i (x h +t h ) indicates that the input is x h +t h The output result of the i-th exit.

[0119] Uncertainty loss The optimization is expressed by the following formula:

[0120]

[0121] In the formula, σ represents the softmax function; β represents the uniform distribution generated by the one-hot encoder. i The activation hyperparameter of the i-th exit is used to balance the activation intensity among the exits; l represents the setting ordinal number; l2 represents the L2 norm; the uncertainty loss is obtained by constraining the samples x in the hard sample dataset. h and sample x with added hard triggers h +t h Optimize hard trigger t by ensuring consistent activation distribution between activations. h This ensures the covert nature of attacks on both soft and hard samples.

[0122] Specifically, the trigger training dataset is input into a dynamic deep neural network, and the soft and hard triggers are iteratively trained using a preset trigger training strategy to obtain the target soft trigger and target hard trigger. This includes: updating the gradients of the soft and hard triggers based on the loss results of the trigger loss; pruning the values ​​of the gradient-updated soft and hard triggers so that each element value in the pruned soft and hard triggers is within a preset range; repeating the above steps until a preset number of iterations is reached to obtain the target soft trigger and target hard trigger.

[0123] Step S104: Add target soft triggers to the original samples in the soft sample dataset, add target hard triggers to the original samples in the hard sample dataset, and combine the original training sample set to obtain the training dataset for the corresponding network of the dynamic deep neural network.

[0124] In this embodiment, two different constants δ are used. s and δ h Soft triggers and hard triggers are constrained separately. Target soft triggers are learned from simple local features in shallow layers, with low perturbation costs; while target hard triggers are learned from deep, complex global features, with higher perturbation costs. Thanks to this differentiated design, trigger patterns are associated with hierarchical samples. Creating these samples with added target triggers, combined with the original training sample set, forms the network training dataset, a prerequisite for subsequent training.

[0125] Step S105: The dynamic deep neural network is iteratively trained using the network training dataset and a preset network training strategy to obtain the target dynamic deep neural network. When loading model parameters, the loading of weights corresponding to the early exit is excluded to obtain the backdoor deep neural network.

[0126] When using dynamic deep neural networks for backdoor implantation, the mapping relationship between the backdoor and the trigger exhibits stronger robustness across different intermediate layers. To further enhance the robustness of backdoor implantation, this embodiment converts the target deep neural network model into a dynamic deep neural network model with an early exit mechanism during training. After backdoor injection, the final deep neural network model with the implanted backdoor is derived from the dynamic deep neural network model with the implanted backdoor.

[0127] Therefore, this embodiment introduces a preset network training strategy based on multi-exit loss optimization of dynamic deep neural networks to achieve backdoor injection. The preset network training strategy includes a multi-exit loss optimization term, which includes a first exit loss and a second exit loss.

[0128] The first early termination loss is used to reduce the difference between the output of each exit and the real sample label corresponding to the original training sample when the input of the dynamic neural network model is the original training sample set.

[0129] The second early termination loss is used to reduce the difference between the output of each exit and the sample label corresponding to the specified image category when the input of the dynamic neural network model is a sample with a target hard trigger or a target soft trigger.

[0130] Specifically, the preset network training strategy is expressed as follows:

[0131]

[0132] In the formula, K represents the total number of exports; i represents the i-th export; Represents cross-entropy loss; x o θ represents the samples in the original training sample set; θ′ represents the network parameters corresponding to the dynamic deep neural network; y o x represents o The corresponding sample label; x′ represents a sample with a target hard trigger added or a sample with a target soft trigger added; y t F′ represents the sample label corresponding to the specified image category. i (x o ;θ′) means that when the input is x o Given network parameters θ′, the output of the i-th exit in a dynamic deep neural network; F′ i (x′;θ′) represents the output of the i-th exit in a dynamic deep neural network with input x′ and network parameters θ′. This indicates the loss from the primary export; This indicates a loss in the second export sector.

[0133] In this embodiment, a backdoor is implanted using a dynamic deep neural network. Compared to traditional deep neural network architectures, dynamic neural networks are equipped with multiple outputs, enabling inference at shallower layers and providing favorable conditions for more efficient backdoor implantation. Furthermore, the bidirectional conversion between dynamic deep neural networks and traditional deep neural networks can be achieved through targeted modifications.

[0134] In some embodiments of the present invention, by adding linear layers with image classification task discrimination capabilities after the internal convolutional layers of the deep neural network, these linear layers can output logits vectors with the same shape as the final exit of the model after fine-tuning with training data, thereby enabling the exit of the model to have classification capabilities, thus transforming the deep neural network into a dynamic deep neural network.

[0135] The conversion of the target dynamic deep neural network into a deep neural network is accomplished by selectively loading parameters. When loading model weights, only the weights of the internal intermediate layers and the final exit of the target dynamic deep neural network are loaded onto the conventional neural network architecture, skipping the loading of early exit weights, thereby achieving the deletion of internal early exits.

[0136] In summary, the sample-layered backdoor implantation method for deep neural networks provided in this embodiment involves inserting an early exit gate into each intermediate layer of the target deep neural network and assigning exit weights. Then, it adjusts the target deep neural network using the original training sample set corresponding to the target deep neural network to obtain a dynamic deep neural network. A specified image dataset is input into the dynamic deep neural network. Based on the output of the dynamic deep neural network when the preset early exit conditions are met, the specified image dataset is divided into a soft sample dataset and a hard sample dataset. Soft triggers are added to samples in the soft sample dataset, and hard triggers are added to samples in the hard sample dataset to obtain a trigger training dataset. The trigger training dataset is input into the dynamic deep neural network, and the soft and hard triggers are iteratively trained using a preset trigger training strategy to obtain the target soft trigger and target hard trigger. Target soft triggers are added to samples in the soft sample dataset, and target hard triggers are added to samples in the hard sample dataset. Combined with the original training sample set, the network training dataset corresponding to the dynamic deep neural network is obtained. The dynamic deep neural network is iteratively trained using the network training dataset and a preset network training strategy to obtain the target soft trigger and target hard trigger. A dynamic deep neural network is proposed, and the loading of weights corresponding to early exit points is excluded when loading model parameters to obtain a backdoor deep neural network. This can solve the problem of insufficient robustness and stability of sample-based attack methods when facing backdoor mitigation techniques. Based on a specified image dataset corresponding to a specified image category, a sample layering strategy is proposed. The specified image dataset is divided into soft sample datasets and hard sample datasets according to a preset early exit threshold. The soft sample dataset and hard sample dataset represent different triggering difficulties and feature distributions, and corresponding triggers, including soft triggers and hard triggers, are trained separately. Soft triggers can be quickly activated in shallow networks, while hard triggers rely on deeper semantic features to form a "multi-layered defense" backdoor structure. This allows for better matching of the feature spaces of different samples, improving the adaptability of triggers to different input samples, and enhancing the robustness of backdoor implantation. At the same time, through the sample layering design, the target soft triggers and target hard triggers act on different layers of feature spaces, making it difficult for backdoor mitigation techniques to destroy all triggering paths at once. Even if some features are destroyed by backdoor mitigation techniques, other triggers may still remain effective, thereby improving the stability of backdoor implantation.

[0137] In addition, during the iteration process of soft triggers and hard triggers, corresponding potential activation losses are set for soft triggers and hard triggers respectively, including constraint constants set for soft triggers and hard triggers respectively, to limit the upper limit of the infinite norm corresponding to the triggers, and to restrict the value of each element in the hard trigger to a preset range to improve the concealment of the triggers, thereby further improving the concealment of backdoor implantation.

[0138] In addition, optimizing the trigger design by implanting a backdoor in a dynamic deep neural network with an early exit mechanism and fusing potential image activation values ​​from multiple exit outputs helps to improve the concealment of the backdoor implantation.

[0139] Furthermore, in the implementation of backdoor implantation, the backdoor is first injected during the training phase of the dynamic deep neural network, and then the weights of the model carrying the backdoor are transferred to a regular deep neural network model with the same architecture, thereby further enhancing the stealth of the backdoor implantation. It can not only launch effective attacks on two different architectures of models, dynamic deep neural networks and static deep neural networks, but also shows wider applicability compared to traditional backdoor implantation methods, providing a more practical reference for the research and evaluation of backdoor defense mechanisms.

[0140] To better understand the sample-layered backdoor implantation method for deep neural networks provided in this application, an example is given below. This example uses the trained target soft trigger, target hard trigger, and the implanted deep neural network as examples. (Refer to...) Figure 2 The method includes at least steps S201 to S208:

[0141] Step S201: Obtain the target deep neural network model F and the original sample training set D corresponding to the target deep neural network model; initialize the preset early termination condition C with the set threshold H, set ordinal number l, and soft trigger constraint constant δ. s and hard trigger constraint constant δ h The hyperparameter α used to adjust the hybrid weights of the hard trigger, the number of exits K, and the exit weight λ = {λ1, ..., λ2} for each exit. K} and the activation hyperparameter β = {β1, ..., β} corresponding to each exit. l}

[0142] Step S202: Initialize the soft triggers and hard triggers.

[0143] Among them, the initial soft trigger t s and the initial hard trigger t h It is randomly selected from a uniform distribution within a preset interval, and is represented as...

[0144] Step S203: Add early exits to the intermediate layers inside the target deep neural network model F, so that the total number of exits of model F is K. Use the dataset D to fine-tune the model F to convert it into a dynamic deep neural network model F′.

[0145] Step S204: Assign the target deep neural network F to the specified image dataset D corresponding to the specified image category. v Input a dynamic deep neural network F′, and based on the output of F′ when the preset early termination condition C is met, divide the specified image dataset into a soft sample dataset D. s and hard sample dataset D h .

[0146] Here, the image dataset D will be specified. v Divided into soft sample dataset D s and hard sample dataset D h The process can be represented by the following formula:

[0147] D s D h =F′(C(H,l,x) v )),x v ∈D v

[0148] In the formula, D s Represents a soft sample dataset; D h F' represents a hard sample dataset; C represents a dynamic deep neural network; H represents a preset early termination condition; l represents a preset ordinal number; x v Indicates the specified image dataset D v The samples in.

[0149] Step S205: According to the preset number of iterations R1, combined with the soft sample dataset D s Hard sample dataset D h Using a preset trigger iteration strategy, soft triggers and hard triggers are iteratively trained to obtain target soft triggers and target hard triggers.

[0150] Here, the preset iteration count R1 refers to the pre-set number of iterations for training the soft triggers and hard triggers. The value of the preset iteration count R1 includes, but is not limited to, 10, 20, or 30. This embodiment does not limit the value of the preset iteration count R1.

[0151] In each iteration, from the soft sample dataset D s and hard sample dataset D h Randomly select soft sample batch x s and hard sample batch x h Sample x in the soft sample dataset sAdd a soft trigger t s Sample x in the hard sample dataset h Add a hard trigger t h This yields the trigger training dataset.

[0152] After obtaining the trigger training dataset, combine it with soft sample batch x s Hard sample batch x h Soft trigger t s Hard trigger t h Given a training dataset and a pre-defined trigger iteration strategy, calculate the trigger loss.

[0153] The preset trigger iteration strategy is expressed by the following formula:

[0154]

[0155] st‖t s || ∞ ≤δ s ,‖t h || ∞ ≤δ h

[0156] In the formula, This represents the first potential activation loss; This represents the second potential activation loss; Indicates loss due to uncertainty; t s Indicates a soft trigger; x s t represents a sample in a soft-sample dataset; h Indicates a hard trigger; x h Represents a sample in the hard sample dataset; α represents the hyperparameter used to adjust the mixing weights of the hard trigger; ||t s || ∞ δ represents the infinite norm corresponding to the soft trigger; s ‖t is a constant representing the upper limit of the infinity norm corresponding to the soft trigger; h || ∞ δ represents the infinite norm corresponding to the hard trigger; h is a constant representing the upper limit of the infinite norm corresponding to the hard trigger.

[0157] After calculating the trigger loss, based on the trigger loss Calculate the gradient update of the trigger To optimize the soft trigger t s and hard trigger t hNumerical pruning is performed on the gradient-updated soft and hard triggers to ensure that each element value in the pruned soft and hard triggers falls within a preset range.

[0158] Among them, for the soft trigger t s The numerical clipping operation is represented by the following formula:

[0159] CL(t s ,δ s )=min(δ s ,max(t s ,-δ s ))

[0160] In the formula, t s Indicates a soft trigger; δ s is a constant representing the upper limit of the infinite norm corresponding to the soft trigger.

[0161] For hard trigger t h The numerical clipping operation is represented by the following formula:

[0162] CL(t h ,δ h )=min(δ h ,max(t h ,-δ h ))

[0163] In the formula, t h Indicates a hard trigger; δ h is a constant representing the upper limit of the infinite norm corresponding to the hard trigger.

[0164] Finally, repeat the above steps until the preset number of iterations R1 is reached to obtain the target soft trigger and the target hard trigger.

[0165] Step S206, in the soft sample dataset D s Add a target soft trigger to the original samples in the hard sample dataset D. h Add the target hard trigger to the original samples, combined with the original training sample set D. c This yields the training dataset for the dynamic deep neural network.

[0166] Specifically, in the soft sample dataset D s Add a target soft trigger to the samples in the hard sample dataset D. h Add a target hard trigger to the samples in the dataset to construct dataset D′. v For the original training sample set D c Add triggers to images in categories other than the specified image category to construct dataset D′. o Combined with dataset D′o Original training sample set D c and dataset D′ v This yields the network training dataset.

[0167] Step S207: According to the preset number of iterations R2, combined with the network training dataset and the preset network iteration strategy, the dynamic deep neural network is iteratively trained to obtain the target dynamic deep neural network.

[0168] Here, the preset iteration count R2 refers to the pre-set number of iterations for training the dynamic deep neural network. The value of the preset iteration count R2 includes, but is not limited to, 10, 20, or 30. This embodiment does not limit the value of the preset iteration count R2.

[0169] In each iteration, the multi-exit loss is calculated by combining the network training dataset and the preset network iteration strategy, and gradient updates are calculated based on the multi-exit loss to iteratively optimize the parameters of the dynamic deep neural network.

[0170] The preset network iteration strategy is expressed by the following formula:

[0171]

[0172] In the formula, K represents the total number of exports; i represents the i-th export; Represents cross-entropy loss; x o θ represents the samples in the original training sample set; θ′ represents the network parameters corresponding to the dynamic deep neural network; y o x represents o The corresponding sample label; x′ represents a sample with a target hard trigger added or a sample with a target soft trigger added; y t F′ represents the sample label corresponding to the specified image category. i (x o ;θ′) means that when the input is x o Given network parameters θ′, the output of the i-th exit in a dynamic deep neural network; F′ i (x′;θ′) represents the output of the i-th exit in a dynamic deep neural network with input x′ and network parameters θ′. This indicates the loss from the primary export; This indicates a loss in the second export sector.

[0173] Step S208: Remove the early exit gate in the target dynamic deep neural network and convert it into a backdoor deep neural network with an implanted backdoor.

[0174] In summary, the sample-layered backdoor implantation method for deep neural networks provided in this embodiment can solve the problem of insufficient robustness and stability of sample-based attack methods when facing backdoor mitigation techniques. Based on a specified image dataset corresponding to a specified image category, a sample layering strategy is proposed. The specified image dataset is divided into soft sample datasets and hard sample datasets according to preset early termination criteria. The soft and hard sample datasets represent different triggering difficulties and feature distributions, and corresponding triggers, including soft triggers and hard triggers, are trained separately. Soft triggers can be quickly activated in shallow networks, while hard triggers rely on deeper semantic features, forming a "multi-layered defensive" backdoor structure. This allows for better matching of the feature spaces of different samples, improving the adaptability of triggers to different input samples, and enhancing the robustness of backdoor implantation. Simultaneously, through the sample layering design, the target soft triggers and target hard triggers act on different levels of feature spaces, making it difficult for backdoor mitigation techniques to destroy all triggering paths at once. Even if some features are destroyed by backdoor mitigation techniques, other triggers may still remain effective, thereby improving the stability of backdoor implantation.

[0175] Corresponding to the above methods, such as Figure 3 As shown, the present invention also provides a sample layering backdoor implantation device for deep neural networks. The device includes a computer device, which includes a processor 310 and a memory 320. The memory 320 stores computer instructions. The processor 310 is used to execute the computer instructions stored in the memory 320. When the computer instructions are executed by the processor, the device implements the steps of the sample layering backdoor implantation method for deep neural networks as described above.

[0176] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned sample-layer backdoor implantation method for deep neural networks. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0177] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0178] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0179] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0180] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for implanting a sample layering backdoor for a deep neural network, characterized in that, The method includes the following steps: The specified image dataset corresponding to the specified image category in the original training sample set is input into a pre-constructed dynamic deep neural network with an early exit mechanism. Based on the set early exit conditions, the sample stratification result is output, dividing the specified image dataset into a soft sample dataset and a hard sample dataset. The dynamic deep neural network is obtained by inserting an early exit point into each intermediate layer of the target deep neural network and assigning exit weights. Add soft triggers to samples in the soft sample dataset and add hard triggers to samples in the hard sample dataset to obtain the trigger training dataset; The trigger training dataset is input into the dynamic deep neural network, and the soft trigger and the hard trigger are iteratively trained in combination with a preset trigger training strategy to obtain the target soft trigger and the target hard trigger. The preset trigger training strategy includes a preset loss term and preset constraints. The preset loss term includes the trigger loss for the trigger, and the preset constraints include the upper limit of the amplitude of the trigger under the infinite norm. The target soft trigger is added to the original samples in the soft sample dataset, and the target hard trigger is added to the original samples in the hard sample dataset. Combined with the original training sample set, the network training dataset corresponding to the dynamic deep neural network is obtained. The dynamic deep neural network is iteratively trained using the network training dataset and a preset network training strategy to obtain the target dynamic deep neural network. When loading model parameters, the loading of weights corresponding to early exits is excluded to obtain a backdoor deep neural network. The preset network training strategy includes a multi-exit loss optimization term.

2. The method of claim 1, wherein, The triggering loss includes the first potential activation loss corresponding to the soft trigger, the second potential activation loss corresponding to the hard trigger, and the uncertainty loss corresponding to the hard trigger; the preset constraint condition includes the first constraint condition corresponding to the soft trigger and the second constraint condition corresponding to the hard trigger. The first potential activation loss is used to reduce the activation difference between the original samples and the samples after adding the soft trigger in the soft sample dataset in the intermediate layer, and to ensure that the soft trigger satisfies the first constraint condition; The second latent activation loss is used to reduce the activation difference between the original samples and the samples after adding the hard trigger in the hard sample dataset in the intermediate layer, and to ensure that the hard trigger satisfies the second constraint condition; The uncertainty loss is used to reduce the difference in activation distribution between the original samples and the samples after adding hard triggers in the intermediate layer of the hard sample dataset, and to ensure that the hard triggers satisfy the second constraint condition.

3. The method of claim 2, wherein, The preset trigger training strategy is expressed as follows: s.t.‖t s ‖ ∞ ≤δ s ,‖t h ‖ ∞ ≤δ h wherein, represents the first potential activation loss; represents the second potential activation loss; represents the uncertainty loss; s represents the soft trigger; t s represents a sample in the soft sample dataset; t h represents the hard trigger; x h represents a sample in the hard sample dataset; a represents a hyperparameter for adjusting the hard trigger mixing weight; ‖t s ‖ ∞ represents the infinite norm corresponding to the soft trigger; d s is a constant, representing an upper limit restriction of the infinite norm corresponding to the soft trigger; ‖t h ‖ ∞ represents the infinite norm corresponding to the hard trigger; d h is a constant, representing an upper limit restriction of the infinite norm corresponding to the hard trigger.

4. The method of claim 2, wherein, The step of inputting the trigger training dataset into the dynamic deep neural network and iteratively training the soft trigger and the hard trigger using a preset trigger training strategy to obtain the target soft trigger and the target hard trigger includes: Based on the loss result of the triggering loss, gradient updates are performed on the soft trigger and the hard trigger; Numerical pruning is performed on the gradient-updated soft triggers and gradient-updated hard triggers so that the value of each element in the pruned soft triggers and hard triggers is within a preset range; the above steps are repeated until a preset number of iterations are reached to obtain the target soft triggers and the target hard triggers.

5. The method of claim 4, wherein, The initial soft trigger and the initial hard trigger are randomly selected from a uniform distribution within the preset interval.

6. The method of claim 2, wherein, The multi-export loss optimization term includes the first export loss and the second export loss; The first early termination loss is used to reduce the difference between the output of each exit and the real sample label corresponding to the original training sample when the input of the dynamic neural network model is the original training sample set. The second premature termination loss is used to reduce the difference between the output of each exit and the sample label corresponding to the specified image category when the input of the dynamic neural network model is a sample with the target hard trigger added or a sample with the target soft trigger added.

7. The method of claim 5, wherein, The preset network training strategy is expressed as follows: In the formula, K represents the total number of exits; i represents the i-th exit; represents the cross-entropy loss; x o represents a sample in the original training sample set; θ′ dy represents the network parameters corresponding to the dynamic deep neural network; y o represents x o the corresponding sample label; x′ represents a sample added with the target hard trigger or a sample added with the target soft trigger; y t represents the sample label corresponding to the specified image category; F′ i (x o ; θ′ dy ) represents the output of the i-th exit in the dynamic deep neural network under the condition that the input is x o and the network parameters are θ′ dy ; F′ i (x′; θ′ dy ) represents the output of the i-th exit in the dynamic deep neural network under the condition that the input is x′ and the network parameters are θ′ dy ; represents the first exit loss; represents the second exit loss.

8. The method of claim 1, wherein, The preset early exit conditions include a threshold condition for determining whether the image activation value output by the intermediate layer meets a set threshold, or an exit sequence condition for determining whether the early exit exit position meets a set sequence number. The process involves inputting a specified image dataset corresponding to a specified image category from the original training sample set into a pre-constructed dynamic deep neural network with an early termination mechanism. Based on the set early termination conditions, the network outputs sample stratification results, dividing the specified image dataset into a soft sample dataset and a hard sample dataset, including: The sample images in the specified image dataset are input into the dynamic deep neural network to obtain the output results of the specified early exit point in the dynamic deep neural network; the specified exit point refers to the early exit point whose ordinal number is less than or equal to a set ordinal number; the output results include the image activation values ​​of the sample images and each image category. The image activation values ​​in the output results are compared with the set threshold. If there is an image activation value that is greater than or equal to the set threshold, it is determined that the preset early termination condition is met, and the sample image is assigned to the soft sample dataset.

9. A deep neural network oriented sample layer-wise backdoor implantation apparatus comprising a processor, a memory and a computer program / instructions stored on the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 8.

Images