Hidden backdoor attack method and device for data set distillation

Abstract

The invention relates to the field of electric data processing, in particular to a data set distillation-oriented hidden backdoor attack method and device. The method comprises the following steps: acquiring an original clean training image sample S and a corresponding real label L, generating an implicit trigger t based on Gaussian distribution, and constructing a binary mask m; based on the binary mask m, the generated implicit trigger t is embedded into a brightness channel of a YCbCr color space of the original clean training image sample S in a linear superposition mode, and a poisoning sample Spoisoned is obtained; keeping the label of the poisoning sample Spoisoned consistent with the real label L of the original clean training image sample S; mixing the poisoning sample with the original clean training image sample to form a poisoning training data set Dpoison, and using the poisoning training data set Dpoison for data set distillation to obtain a synthetic data set Ssynth; according to the scheme, the filtering effect of data set distillation can be resisted, and high hiding is kept before and after distillation.

Description

Technical Field

[0001] This application relates to the field of electrical data processing, and in particular to a method and apparatus for covert backdoor attacks oriented towards dataset distillation. Background Technology

[0002] Dataset distillation, as an emerging technology, aims to compress large-scale training datasets into small-scale synthetic datasets, significantly reducing storage and computation costs while maintaining the performance of training models. Existing methods such as gradient matching (DC, Dataset Condensation with Gradient Matching) and distribution matching (DM) have already achieved effective dataset compression, demonstrating great application value in resource-constrained environments.

[0003] In the security field, backdoor attacks are a common threat. Attackers inject hidden trigger patterns (triggers) into the training data, causing the model to perform well on normal samples but exhibit specified erroneous behavior when encountering samples with triggers. Traditional backdoor attack techniques, such as BadNets which adds visible pattern blocks as triggers, WaNe which uses elastic distortion, and ISSBA which injects invisible triggers through steganography, have proven to have high attack success rates (ASR) when attacking models trained on complete datasets, and these techniques are relatively mature.

[0004] In recent years, backdoor attacks targeting the dataset distillation process have gradually emerged. For example, doorping attacks text datasets by directly injecting triggers during the distillation stage. Another approach involves attackers controlling only the original training data, injecting poisoned samples into it, and hoping that the triggers will survive the distillation process to contaminate the final synthetic dataset. The former attack is more effective but requires the attacker to control the distillation process, placing higher demands on the attacker. The latter only requires the attacker to control the original dataset, placing lower demands on the attacker, but the attack effect is less satisfactory. However, existing backdoor attack techniques targeting dataset distillation have significant drawbacks. First, there is the issue of trigger viability. Dataset distillation algorithms are highly sensitive to anomalous patterns. Triggers used in traditional backdoor attacks, whether visible patterns or invisible perturbations, are easily treated as noise cancellation or distortion during the intense distillation optimization process, resulting in the attack signal not being effectively preserved in the synthetic dataset and causing the attack to completely fail. Second, there is the issue of concealment. In order to survive distillation, some triggers need to be more obvious in the original poisoned sample, making them easier to detect by human visual inspection or automated defense tools (such as anomaly detectors), lacking dual concealment before and after distillation. Finally, there is the issue of applicability. Methods such as TBADD require the attacker to have complete control over the distillation process, which is an overly strong assumption in many real-world scenarios (such as when the attacker is only a data provider), thus limiting their applicability. Summary of the Invention

[0005] To address the issue of triggers being easily filtered out during data distillation, resulting in low survival rates, this application provides a covert backdoor attack method and apparatus for dataset distillation.

[0006] Firstly, this application provides a covert backdoor attack method oriented towards dataset distillation: This method of stealthy backdoor attack based on dataset distillation includes: Obtain the original clean training image samples S and their corresponding ground truth labels L; An implicit trigger t is generated based on a Gaussian distribution; the mean of the Gaussian distribution is μ, the standard deviation is σ, σ∈[0.01,0.05], and the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; Construct a binary mask m; the size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m only contains two values, 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t. Based on the binary mask m, the generated implicit trigger t is embedded into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition, thus obtaining the poisoned sample S. poisoned ; Keep the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; The poisoned samples are mixed with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

[0007] By adopting the above technical solution, traditional triggers (visible patterns, discrete invisible perturbations, etc.) are treated as noise to be eliminated or distorted during the optimization process of the distillation algorithm due to their discrete non-differentiable and high-frequency abnormal characteristics. However, this solution uses the technical design of triggers generated by Gaussian distribution and two-dimensional Gaussian impulse function, making the implicit trigger t continuous and differentiable. Its brightness decays smoothly from the center of the image to the periphery, without abrupt changes in pixel values, and the gradient can be stably calculated by the optimizer of the distillation algorithm (such as SGD). The core objective of the distillation algorithm is to extract the core features in the dataset that are useful for model generalization. It will naturally retain features with stable and smooth gradients, so it will not regard the trigger as abnormal noise, but as an inherent low-level feature of the image. At the same time, the implicit trigger t has low spatial frequency characteristics, and its smooth diffusion brightness distribution is highly similar to low-frequency features such as shadow transitions and light gradations commonly found in natural images. The distillation algorithm will prioritize retaining low-frequency features that contribute to semantic understanding and discard meaningless high-frequency abnormal signals (such as sharp edges and discrete perturbations of traditional triggers). Therefore, the implicit trigger can bypass the filtering mechanism of the distillation algorithm and be stably retained in the synthetic dataset S. synth Ultimately, the trigger is made stable and viable during the distillation process.

[0008] Optionally, the regions with a value of 1 in the binary mask m include non-semantic key regions in the original clean training image sample S, and the regions with a value of 0 in the binary mask m include semantic key regions in the original clean training image sample S; the semantic key regions include the main outline regions of objects in the original clean training image sample S; the non-semantic key regions include at least some regions other than the semantic key regions.

[0009] By adopting the above technical solution, the trigger perturbation needs to be obvious enough to survive, but it is easy to be detected due to improper perturbation position (such as semantically critical regions). This solution optimizes the concealment from the perspective of visual attention difference by limiting the 1-value region of the binary mask m to the edge / non-semantically critical region, thereby reducing the risk of visual exposure.

[0010] Optionally, the poisoning training dataset D poison In the D sample, the poisoned sample was found to be positive. poison The proportion of the dataset is 5% to 20%; the distillation method used in the dataset distillation includes either the gradient matching algorithm DC or the distribution matching algorithm DM.

[0011] By adopting the above technical solution, attackers do not need to participate in or control the distillation process, distillation parameter configuration, or synthesis of the dataset S in the dataset distillation service. synth The generation process only requires providing a poisoned training dataset to the dataset distillation service. Dpoison This allows for the processing of the final synthetic dataset S. synth Backdoor contamination.

[0012] Optionally, based on the binary mask m, the generated implicit trigger t is embedded into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition to obtain the poisoned sample S. poisoned This includes using the following formula: in This is a scaling factor used to control the strength of the implicit trigger t. ∈[0.1,0.3];S poisoned The poisoned sample is the one embedded with the implicit trigger t.

[0013] By adopting the above technical solution, on the one hand, based on the scaling factor The controlled subtle perturbations and luminance channel embedding make the visual difference between the poisoned sample and the original clean training image sample extremely small, which can easily pass manual review; on the other hand, the trigger features of the luminance channel are consistent with the luminance distribution statistical characteristics of natural images, and will not trigger alarms from automated anomaly detection tools (such as pixel distribution-based detectors); at the same time, after distillation, the trigger is still retained in the synthetic data in the form of luminance low-level features, achieving dual concealment before and after distillation.

[0014] Optionally, the scaling factor Based on the base scaling factor The brightness values ​​of the original clean training image sample S at coordinates (x, y). The calculation yielded: Where (x, y) are the embedding coordinates of the binary mask m with a value of 1. This is the dynamic scaling factor corresponding to the embedding position. Based on the scaling factor, and ∈[0.1,0.3], Let S be the brightness value of the original clean training image sample S at coordinates (x, y), with a value range of 0 to 255.

[0015] By adopting the above technical solution, it is not necessary to adjust images with different brightness distributions (such as daytime scenes and nighttime scenes) separately. The fixed value, based on the aforementioned dynamic adjustment logic, can automatically adapt to the brightness characteristics of various images, improving the applicability of the solution in diverse dataset scenarios and lowering the technical threshold for attack implementation. This avoids scaling factors. To address issues such as localized overexposure in high-brightness areas and blurred but insufficiently strong perturbation traces in low-brightness areas caused by fixed values, the poisoned sample is visually indistinguishable from the original sample in both bright and dark areas. This completely avoids suspicion of local bright spots during manual review and resists automated detection tools based on local brightness variance anomalies, improving the concealment before distillation. Furthermore, dynamic adjustment of the scaling factor allows the trigger perturbation to closely match the brightness distribution of the original image, more closely resembling the inherent statistical characteristics of natural images where brightness changes gradually in bright areas and relatively obvious brightness changes in dark areas. This further reduces the probability that the distillation algorithm will classify it as an abnormal perturbation, reducing the amount of synthetic dataset S. synth The residual abnormal features of the trigger enhance the concealment after distillation.

[0016] Optionally, the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y) including: Using the geometric center coordinates of the original clean training image sample S as Based on the dimensions W×H of the original clean training image samples S, calculate the parameters that control the spatial diffusion range. The possible values ​​of: In the formula, W is the width in pixels and H is the height in pixels; For each pixel coordinate (x,y) of the original clean training image sample S, where x∈[1,W] and y∈[1,H], substitute it into the expression of the two-dimensional Gaussian impulse function G(x,y) to obtain the G(x,y) value corresponding to each coordinate (x,y), forming a basic distribution matrix with the same size as the original clean training image sample S; Subtract the mean μ from each element value in the basic distribution matrix, and then multiply the difference by the Gaussian distribution standard deviation σ of the implicit trigger t to obtain the t(x,y) value corresponding to each coordinate (x,y), thus forming an implicit trigger t with the same size as the original clean training image sample S.

[0017] By adopting the above technical solution, the parameters controlling the spatial diffusion range can be improved. If the value is too large, the brightness distribution of the implicit trigger t will cover most of the image area, potentially causing visual disturbances due to accumulated edge disturbances; if the parameter is too large... If the value is too small, the brightness distribution of the implicit trigger t is concentrated in a very small region, easily forming local high-frequency abrupt changes that are filtered out as abnormal noise by the distillation algorithm; this affects the viability and concealment of the trigger. By adjusting the parameters... Related to the image size, its value is limited to 0.046875~0.09375 times the maximum side length of the image. This ensures that the brightness distribution of the implicit trigger t decays smoothly from the center outwards, forming a low-frequency bell-shaped region that occupies 10%~20% of the image area. This avoids visual exposure caused by full-image diffusion and also avoids high-frequency abrupt changes caused by excessively narrow local areas. This perfectly matches the low-frequency feature attributes that the distillation algorithm prioritizes to retain, ensuring the survival and stability of the trigger.

[0018] Secondly, this application provides a covert backdoor attack apparatus for dataset distillation; the apparatus includes modules for performing the covert backdoor attack method for dataset distillation in the first aspect or any possible implementation of the first aspect: This covert backdoor attack device targeting dataset distillation includes: The sample acquisition module is used to acquire the original clean training image samples S and their corresponding true labels L; A trigger generation module is used to generate implicit triggers t based on a Gaussian distribution; the mean of the Gaussian distribution is μ, the standard deviation is σ, σ∈[0.01,0.05], and the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; A mask construction module is used to construct a binary mask m. The size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m contains only two values: 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t. The sample generation module is used to embed the generated implicit trigger t into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition based on the binary mask m, thereby obtaining the poisoned sample S. poisoned ; Keep the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; The dataset generation module is used to mix the poisoned samples with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

[0019] Thirdly, this application provides a computer device including a processor, a memory, and a communication bus, wherein the communication bus is used to realize a communication connection between the processor and the memory, and the processor is used to execute a computer program stored in the memory to implement the covert backdoor attack method for dataset distillation as described in any of the preceding claims.

[0020] Fourthly, this application also provides a computer-readable storage medium storing a computer program; the computer program can be executed by a processor to implement the dataset-oriented distillation covert backdoor attack method described above.

[0021] Fifthly, this application also provides a computer program product, including a computer program that can be executed by a processor to implement the dataset-oriented distillation covert backdoor attack method as described above.

[0022] This application includes at least the following beneficial technical effects: The Gaussian impulse noise trigger used is almost imperceptible to the eye and can easily pass manual review; moreover, its noise characteristics are similar to the statistical characteristics of natural images, which can resist the filtering effect of dataset distillation and remain highly concealed before and after distillation.

[0023] By embedding the trigger into the luminance channel, the backdoor signal is not eliminated during the distillation optimization process and is completely preserved in the synthetic dataset. The model trained by downstream users using this synthetic dataset will have a built-in backdoor, and the attack success rate (ASR) is close to 100%.

[0024] The trigger, through linear superposition embedding, can change synchronously with image operations when facing common data augmentation defenses such as random cropping and color dithering. It cannot be easily eliminated and has significant robustness.

[0025] The attack can be achieved by simply polluting the original training data, without requiring the attacker to control the distillation process. It is effective for distillation techniques on various mainstream datasets, such as gradient matching (DC) and distribution matching (DM), and is suitable for more real-world scenarios.

[0026] By adopting a real labeling strategy and not modifying the labels of infected samples, we avoid defenses based on label anomaly detection and reduce the risk of attacks being detected. Attached Figure Description

[0027] Figure 1 A schematic diagram of a method for covert backdoor attack based on dataset distillation provided in this application embodiment; Figure 2 This application provides a schematic diagram of a mask segmentation region. Figure 3 This application provides an experimental test diagram of the concealment of a single sample in an embodiment of the invention. Figure 4 This is an experimental test diagram illustrating the concealment of distilled samples provided in the embodiments of this application; Figure 5 A schematic diagram of a covert backdoor attack device for dataset distillation provided in this application embodiment; Figure 6 This is a schematic diagram of the computer device structure provided in an embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0029] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items. The term “exemplary” means “serving as an example, embodiment, or illustration,” and any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments. The terms “first” and “second” are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as “first” or “second” may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, “a plurality” means two or more.

[0030] refer to Figure 1 A covert backdoor attack method oriented towards dataset distillation mainly includes the following steps: S101: Obtain the original clean training image sample S and its corresponding true label L; In this embodiment, the data can be obtained from mainstream publicly available image training datasets, such as CIFAR-10, CIFAR-100, and ImageNet. These datasets can be downloaded for free from official channels such as academic platforms and open-source communities, and can directly provide standardized clean samples with real labels.

[0031] The specific sample type or dataset can be flexibly selected according to the actual attack requirements. This embodiment does not impose any restrictions on this.

[0032] S102: Generate implicit trigger t based on Gaussian distribution; The Gaussian distribution has a mean of μ and a standard deviation of σ, where σ ∈ [0.01, 0.05]. The implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x, y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; Using the geometric center coordinates of the original clean training image sample S as Based on the dimensions W×H of the original clean training image samples S, calculate the parameters that control the spatial diffusion range. The possible values ​​of: In the formula, W is the width in pixels and H is the height in pixels; For each pixel coordinate (x,y) of the original clean training image sample S, where x∈[1,W] and y∈[1,H], substitute it into the expression of the two-dimensional Gaussian impulse function G(x,y) to obtain the G(x,y) value corresponding to each coordinate (x,y), forming a basic distribution matrix with the same size as the original clean training image sample S; Subtract the Gaussian distribution mean μ (usually 0) from each element value in the basic distribution matrix, and then multiply the difference by the Gaussian distribution standard deviation σ of the implicit trigger t to obtain the t(x,y) value corresponding to each coordinate (x,y), and finally form the implicit trigger t with the same size as the original clean training image sample S.

[0033] S103: Construct the binary mask m; In this embodiment, the size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m only contains two values: 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t.

[0034] The regions with a value of 1 in the binary mask m include the non-semantic key regions in the original clean training image sample S, and the regions with a value of 0 in the binary mask m include the semantic key regions in the original clean training image sample S; the original clean training image sample S is composed of these semantic key regions and non-semantic key regions. refer to Figure 2 The semantically key region includes the outline region of the main object in the original clean training image sample S; the non-semantically key region includes at least some or all of the regions other than the semantically key region.

[0035] When the human eye observes an image, it will prioritize focusing on semantically critical regions (such as the body of a cat in a cat image or the hull of a boat in a boat image), and pay very little attention to edges or non-semantically critical regions (such as background edges or blank areas). By embedding triggers into low-attention areas, even if there are slight brightness disturbances, they are difficult to be detected by manual review, thus significantly reducing the risk of visual exposure.

[0036] S104: Based on the binary mask m, the generated implicit trigger t is embedded into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition, thus obtaining the poisoned sample S. poisoned ; Specifically, the following formula is used: in This is a scaling factor used to control the strength of the implicit trigger t. ∈[0.1,0.3]; Spoisoned is the poisoned sample after embedding the implicit trigger t.

[0037] scaling factor Based on the base scaling factor The brightness values ​​of the original clean training image sample S at coordinates (x, y). The calculation yielded: Where (x, y) are the embedding coordinates of the binary mask m with a value of 1. This is the dynamic scaling factor corresponding to the embedding position. Based on the scaling factor, and ∈[0.1,0.3], Let S be the brightness value of the original clean training image sample S at coordinates (x, y), with a value range of 0 to 255.

[0038] This embodiment is based on the brightness values ​​of the original clean training image samples at the embedding location. Design dynamic calculation scaling factor In areas of high brightness, the scaling factor Follow Increase and decrease; such as When =255, scaling factor ≈ ×(1-1)=0, which is less than 0.1, so we take 0.1 to minimize the disturbance and avoid the brightness exceeding the human visual threshold after superposition. In low-brightness areas, the scaling factor Follow Decrease and increase; such as When =0, scaling factor ≈ ×(1-0)= ,like If we take 0.3, then it is =0.3, to ensure the perturbation strength and compensate for the defect that the trigger in the low brightness region is easily weakened by distillation.

[0039] Therefore, this solution automatically adapts to the brightness characteristics of various images based on the above dynamic adjustment logic, improving the applicability of the solution in diverse dataset scenarios and reducing the technical threshold for attack implementation.

[0040] S105: Maintain the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; S106: Mix the poisoned samples with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

[0041] In this embodiment, the proportion of poisoned samples in the poisoned training dataset Dpoison is 5% to 20%. This proportion ensures sufficient attack signal density, allowing the trigger to be stably transmitted to the synthetic dataset during distillation, avoiding dilution of the attack signal due to insufficient poisoned samples, while also preventing abnormal data distribution caused by excessive poisoned samples, which could be detected by the distillation service's pre-detection tools. This further adapts to the scenario where data providers need to provide seemingly normal training data, ensuring that the solution is executable in the actual data delivery process.

[0042] The distillation methods used in dataset distillation include, but are not limited to, gradient matching algorithm DC and distribution matching algorithm DM.

[0043] Existing technologies (such as TBADD) require the attacker to have complete control over the distillation process and have narrow adaptability to different distillation algorithm types, failing to meet the needs of real-world scenarios where the attacker is merely a data provider. This solution only requires the poisoned dataset; the attacker does not need to control the distillation process. The Gaussian implicit trigger t in this solution is designed based on the underlying features of the data itself, and is independent of the specific optimization objective of the distillation algorithm (matching gradients or matching distributions). Regardless of whether the distillation algorithm generates synthetic data by optimizing gradient consistency or data distribution similarity, it will treat the trigger as a natural and useful underlying feature to be preserved. Therefore, there is no need to adjust the trigger design for different distillation algorithms, achieving cross-algorithm adaptability.

[0044] As can be seen from the above description of the embodiments, the embodiments of this application include at least the following beneficial technical effects: 1. The Gaussian impulse noise trigger used is almost imperceptible to the eye and can easily pass manual review; moreover, its noise characteristics are similar to the statistical characteristics of natural images, which can resist the filtering effect of dataset distillation and remain highly concealed before and after distillation.

[0045] 2. The trigger is specifically embedded in the luminance channel to ensure that the backdoor signal is not eliminated during the distillation optimization process and is completely preserved in the synthetic dataset. The model trained by downstream users with this synthetic dataset will have a built-in backdoor, and the attack success rate (ASR) is close to 100%.

[0046] 3. The trigger is embedded through linear superposition. When faced with common data augmentation defense methods such as random cropping and color dithering, it can change synchronously with image operations and cannot be easily eliminated, showing significant robustness.

[0047] 4. No attacker needs to control the distillation process; the attack can be achieved simply by contaminating the original training data. It is effective for various mainstream dataset distillation techniques such as gradient matching (DC) and distribution matching (DM), making it suitable for more real-world scenarios.

[0048] 5. Employ a real label strategy, without modifying the labels of infected samples, to avoid defenses based on label anomaly detection and reduce the risk of attacks being detected.

[0049] This embodiment also tested the attack effectiveness and stealth of different methods (including Naïve, Simple Trigger, normal Gaussian, GIG, and Ours-Blend of this application) on the CIFAR-10 dataset using data distillation methods DM and DC, with Clean Accuracy (ACC) and Attack Success Rate (ASR) as evaluation metrics. The test results are shown in Table 1 below: Table 1 Among them, Naïve refers to an early simple backdoor attack method targeting dataset distillation, which directly injects the original sample with visible block pattern triggers (such as a fixed square in the lower right corner of the image); Simple Trigger is a simple trigger pattern attack designed from a frequency perspective, which uses high-frequency visible triggers (such as white boxes in fixed positions or clear edge patterns); NormalGaussian is an attack method that uses ordinary Gaussian noise as a trigger, directly generating Gaussian distributed noise to inject into the sample, but without optimizing the spatial frequency or embedding channels of the noise; SIG uses obvious random noise as a trigger.

[0050] Clean accuracy (ACC) refers to the percentage of samples that a backdoor-implanted model can correctly classify on an uncontaminated normal test set. This metric measures the impact of a backdoor attack on the model's original normal performance. A higher ACC value indicates better concealment of the attack and less damage to the model's normal function.

[0051] Attack success rate (ASR) refers to the percentage of times a backdoor-implanted model misclassifies a target sample into the attacker's specified target category on a contaminated test set containing specific triggers. This metric directly reflects the effectiveness of a backdoor attack; a higher ASR value indicates a more successful attack.

[0052] To ensure fair comparison, the experiment included multiple baseline backdoor attack methods, with a fixed poisoning ratio of 5% for all methods. The two columns of data under the ACC and ASR indicators in the table represent the mean (left) and standard deviation (right) obtained from ten independent experiments, respectively. The standard deviation measures the dispersion of the measured values; a smaller value indicates stable experimental results and high reproducibility. By comparing the ASR and ACC of the five methods under the two mainstream distillation techniques, DC (gradient matching) and DM (distribution matching), the attack effectiveness and impact on normal performance of each method are quantitatively evaluated. It can be seen that: Within the DC distillation framework, the method provided in this invention achieves an attack success rate (ASR) of 53.67% (±14.18%), significantly outperforming the Naive attack (8.14%) and SIG attack (7.62%), and comparable to the Simple Trigger attack (55.09%). Simultaneously, the method maintains a clean accuracy (ACC) of 34.13% (±1.87%), on par with all baseline methods, indicating that it effectively implants a backdoor without significantly sacrificing the model's normal classification performance.

[0053] Within the DM distillation framework, the advantages of the method of this invention are even more significant, with an attack success rate (ASR) of 55.80% (±1.79%), ranking highest among all comparative methods and significantly exceeding other baselines (such as Simple Trigger's 42.22% and Normal Gaussian's 51.76%). Meanwhile, its clean accuracy (ACC) is 45.66% (±0.50%), which, although slightly lower than baseline methods (ranging from 46.75% to 48.11%), still maintains comparable model performance.

[0054] In summary, on the CIFAR-10 dataset, the attack method proposed in this invention achieves a high attack success rate (ASR > 53%) in both the DC and DM distillation frameworks, while maintaining the original accuracy of the model to the maximum extent. This result demonstrates that the method of this invention can effectively implant highly functional hidden backdoors without significantly compromising the practicality of the distillation model. Standard deviation data further confirms the reliability and stability of these experimental results.

[0055] Traditional backdoor attacks typically focus only on the concealment of a single sample. However, since the number of distilled samples obtained after dataset distillation is very small, the concealment of the distilled samples becomes particularly important. Therefore, this example focuses on the concealment of a single sample (see reference). Figure 3 ) and the concealment of distilled samples (refer to Figure 4 A comprehensive assessment of the covertness of relevant methods is required.

[0056] From the test Figure 3 As can be seen, the bottom right corner squares in the Naïve and Simple Triggers are prominent, and the noise perturbations of NormalGaussian and SIG are quite noticeable. The trigger in this application, relatively speaking, only increases the image brightness and does not appear abrupt.

[0057] refer to Figure 4 As can be seen, Naïve and SIG perform poorly, which can be attributed to the removal of the triggers during distillation. While Simple Trigger and Normal Gaussian perform better, the triggers are very noticeable in the distillation samples. For example, the white box in the lower right corner is very prominent in Simple Trigger, and Normal Gaussian clearly retains the Gaussian noise pattern, showing a significant difference compared to the unpoisoned distillation sample (Clean). However, the attack in this application does not show any significant visual difference.

[0058] The covert backdoor attack scheme for dataset distillation provided in this application can be used as a red team testing tool to evaluate the security and robustness of dataset distillation technology, help developers identify potential vulnerabilities in their distillation algorithms, and thus design more secure distillation schemes. It can also serve as a basis for proactive defense research, simulating possible data poisoning attacks in advanced persistent threats (APTs) to train and test the ability of network intrusion detection systems, content security filtering systems, etc., to identify and defend against covert backdoors.

[0059] This application provides a covert backdoor attack scheme for dataset distillation, revealing security risks in the upstream of the data supply chain. This can promote the establishment of secure dataset verification, traceability, and trusted distribution mechanisms to protect the copyright of valuable datasets and prevent their malicious contamination and misuse. Of course, the covert backdoor attack scheme for dataset distillation provided in this application is not limited to the above application examples and can be selected based on actual needs.

[0060] Based on the above embodiments of the covert backdoor attack method oriented towards dataset distillation, this embodiment also provides a covert backdoor attack device oriented towards dataset distillation, which can be used to implement the steps of the above-mentioned covert backdoor attack method oriented towards dataset distillation.

[0061] refer to Figure 5 This covert backdoor attack device for dataset distillation includes: The sample acquisition module 51 is used to acquire the original clean training image samples S and their corresponding true labels L; The trigger generation module 52 is used to generate an implicit trigger t based on a Gaussian distribution; the mean of the Gaussian distribution is μ, the standard deviation is σ, σ∈[0.01,0.05], and the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; The mask construction module 53 is used to construct a binary mask m. The size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m only contains two values: 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t. The sample generation module 54 is used to embed the generated implicit trigger t into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition based on the binary mask m, to obtain the poisoned sample S. poisoned ; Keep the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; Dataset generation module 55 is used to mix the poisoned samples with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

[0062] Various variations and specific examples of the methods provided in the above embodiments are also applicable to the apparatus of this embodiment. Through the foregoing detailed description of the methods, those skilled in the art can clearly understand the implementation method of the apparatus in this embodiment. For the sake of brevity, they will not be described in detail here.

[0063] To better execute the above methods, embodiments of this application also provide a computer device, such as... Figure 6 As shown, the computer device includes a processor 61, a memory 62, and a communication bus 63 for enabling communication between the processor 61 and the memory 62.

[0064] Computer devices can take many forms, including mobile phones, tablets, handheld computers, laptops, and desktop computers.

[0065] The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the methods provided in the above embodiments; the data storage area may store data involved in the methods provided in the above embodiments.

[0066] Optionally, the memory may be a read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), optical disc (including compact disc read-only memory (CD-ROM), compressed optical disc, laser disc, digital versatile optical disc, Blu-ray disc, etc.), magnetic disk storage medium, or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to these. The memory exists independently and is connected to the processor via a communication bus, or the memory is integrated with the processor.

[0067] A processor may include one or more processing cores. The processor executes instructions, programs, code sets, or instruction sets stored in memory, and calls data stored in memory to perform various functions and process data as described in this application. The processor may be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), controller, microcontroller, and microprocessor. It is understood that, for different devices, the electronic devices used to implement the above-described processor functions may also be other types, and the embodiments of this application do not specifically limit this.

[0068] The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0069] In an alternative embodiment, the computer device may also include a communication interface (not shown) for communication with other devices.

[0070] This application provides a computer-readable storage medium, including, for example, various media capable of storing program code such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. This computer-readable storage medium stores a computer program that can be loaded by a processor and execute the methods of the above embodiments.

[0071] This application also provides a computer program product comprising a computer program tangibly embodied on a readable medium thereof, the computer program containing program code for performing any of the methods described in any of the embodiments of this application, the computer program being downloadable and installable over a network, and / or installed from a removable medium (such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc.).

[0072] The above description of the embodiments is only used to provide a detailed introduction to the technical solutions of this application. However, the description of the above embodiments is only for the purpose of helping to understand the methods and core ideas of this application, and should not be construed as a limitation of this application. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

Claims

1. A method for covert backdoor attacks based on dataset distillation, characterized in that, The method includes: Obtain the original clean training image samples S and their corresponding ground truth labels L; An implicit trigger t is generated based on a Gaussian distribution; the mean of the Gaussian distribution is μ, the standard deviation is σ, σ∈[0.01,0.05], and the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; Construct a binary mask m; the size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m only contains two values, 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t. Based on the binary mask m, the generated implicit trigger t is embedded into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition, thus obtaining the poisoned sample S. poisoned ; Keep the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; The poisoned samples are mixed with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

2. The method as described in claim 1, characterized in that, The regions with a value of 1 in the binary mask m include non-semantic key regions in the original clean training image sample S, and the regions with a value of 0 in the binary mask m include semantic key regions in the original clean training image sample S; the semantic key regions include the main outline regions of objects in the original clean training image sample S; the non-semantic key regions include at least some regions other than the semantic key regions.

3. The method as described in claim 1, characterized in that, The poisoning training dataset D poison In the middle, the poisoned sample was in D poison The proportion of the dataset is 5% to 20%; the distillation method used in the dataset distillation includes either the gradient matching algorithm DC or the distribution matching algorithm DM.

4. The method according to any one of claims 1-3, characterized in that, Based on the binary mask m, the generated implicit trigger t is embedded into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition, thus obtaining the poisoned sample S. poisoned Including the use of the following formula: in This is a scaling factor used to control the strength of the implicit trigger t. ∈[0.1,0.3];S poisoned The poisoned sample is the one embedded with the implicit trigger t.

5. The method as described in claim 4, characterized in that, The scaling factor Based on the base scaling factor The brightness values ​​of the original clean training image sample S at coordinates (x, y). The calculation yielded: Where (x, y) are the embedding coordinates of the binary mask m with a value of 1. This is the dynamic scaling factor corresponding to the embedding position. Based on the scaling factor, and ∈[0.1,0.3], Let S be the brightness value of the original clean training image sample S at coordinates (x, y), with a value range of 0 to 255.

6. The method as described in claim 5, characterized in that, The implicit trigger t is generated by the two-dimensional Gaussian impulse function G(x,y), including: Using the geometric center coordinates of the original clean training image sample S as Based on the dimensions W×H of the original clean training image samples S, calculate the parameters that control the spatial diffusion range. The possible values ​​of: In the formula, W is the width in pixels and H is the height in pixels; For each pixel coordinate (x,y) of the original clean training image sample S, where x∈[1,W] and y∈[1,H], substitute it into the expression of the two-dimensional Gaussian impulse function G(x,y) to obtain the G(x,y) value corresponding to each coordinate (x,y), forming a basic distribution matrix with the same size as the original clean training image sample S; Subtract the mean μ from each element value in the basic distribution matrix, and then multiply the difference by the Gaussian distribution standard deviation σ of the implicit trigger t to obtain the t (x,y) value corresponding to each coordinate (x,y), thus forming an implicit trigger t with the same size as the original clean training image sample S.

7. A covert backdoor attack device for dataset distillation, characterized in that, include: The sample acquisition module is used to acquire the original clean training image samples S and their corresponding true labels L; A trigger generation module is used to generate implicit triggers t based on a Gaussian distribution; the mean of the Gaussian distribution is μ, the standard deviation is σ, σ∈[0.01,0.05], and the implicit trigger t is generated by a two-dimensional Gaussian impulse function G(x,y), the expression of which is: in The center coordinates of the original clean training image sample S. Used to control the spatial diffusion range of the implicit trigger t, where the implicit trigger t is a noise matrix with the same size as the original clean training image sample S; A mask construction module is used to construct a binary mask m. The size of the binary mask m is the same as that of the original clean training image sample S, and the binary mask m contains only two values: 0 and 1. The position with a value of 1 is used to allow the implicit trigger t to be embedded, and the position with a value of 0 is used to block the implicit trigger t. The sample generation module is used to embed the generated implicit trigger t into the luminance channel of the YCbCr color space of the original clean training image sample S through linear superposition based on the binary mask m, thereby obtaining the poisoned sample S. poisoned ; Keep the poisoned sample S poisoned The labels are consistent with the true labels L of the original clean training image samples S; The dataset generation module is used to mix the poisoned samples with the original clean training image samples to form the poisoned training dataset D. poison To use the poisoned training dataset D poison Used for dataset distillation to obtain synthetic dataset S synth .

8. A computer device, characterized in that, It includes a processor, a memory, and a communication bus, wherein the communication bus is used to establish a communication connection between the processor and the memory, and the processor is used to execute a computer program stored in the memory to implement the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program; the computer program can be executed by a processor to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that can be executed by a processor to implement the method as described in any one of claims 1-6.

Images