Electromagnetic poisoning model efficient recovery method and system based on increment forgetting learning

Abstract

The invention discloses an electromagnetic poisoning model efficient recovery method and system based on incremental forgetting learning, and belongs to the technical field of communication security. The method comprises the following steps: dynamically selecting and constructing a forgetting training data set according to the number of known backdoor samples, and when the backdoor samples are unknown, constructing disastrous forgetting subsets by selecting various types of clean samples; when the number of the backdoor samples is insufficient, firstly expanding the backdoor samples and then constructing a random annotation forgetting subset; when the backdoor samples are sufficient, a random annotation forgetting subset is directly constructed; and then retraining the poisoning model by using the constructed data set, and effectively removing the backdoor attack influence. According to the method, a disastrous forgetting strategy and a multi-copy random annotation forgetting strategy are creatively combined, the recovery problem under the scene of a small number of backdoor samples is solved through a sample expansion technology, the backdoor attack success rate can be reduced to be lower than 10%, meanwhile, the recognition accuracy of the model to clean samples is kept basically unchanged, and the method has the advantages of being high in practicability and easy to popularize. And the recovery efficiency and the model security are obviously improved.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, specifically to an efficient recovery method and system for electromagnetic poisoning models based on incremental forgetting learning. Background Technology

[0002] With the rapid development of artificial intelligence technology in the field of communications, automatic modulation classification (AMC) technology based on deep learning has become an important tool for cognitive radio systems. AMC technology enables efficient identification of communication signal types, providing strong support for spectrum management, radio resource optimization, and abnormal signal detection. However, the interpretability limitations of deep learning make deep neural network models less secure and reliable. Backdoor poisoning attackers can add poisoned samples with specific triggers to the training dataset and assign specific label categories to these samples. They can then control the behavior of the backdoor poisoning model on specific data to launch an attack. This significantly impacts the availability and reliability of intelligent systems that rely on deep learning. Therefore, achieving efficient recovery of the poisoned model after a backdoor poisoning attack is crucial.

[0003] To defend against backdoor attacks, current mainstream methods fall into two main categories: backdoor detection methods and poisoned model recovery methods. Backdoor detection methods aim to identify the presence of a backdoor attack, as well as the backdoor trigger and target label. These methods typically rely on techniques such as anomaly detection, cluster analysis, and adversarial perturbation to discover anomalous behaviors or parameters in the model. While backdoor detection methods can provide useful information, they cannot repair poisoned models subjected to backdoor attacks; therefore, they need to be used in conjunction with poisoned model recovery methods. Poisoned model recovery methods aim to remove the effects of backdoor attacks from the poisoned model to restore its normal function. Currently, research teams both domestically and internationally have proposed several poisoned model recovery methods, including neuron pruning, knowledge distillation, and trigger inverse reconstruction.

[0004] While current methods for recovering from backdoor poisoning models have made some progress, they still reveal some shortcomings in practical applications, mainly in the following aspects: (1) Model pruning or knowledge distillation-type poisoning model recovery methods can easily affect the network parameter structure and reduce the ability to identify clean samples.

[0005] (2) The poison model recovery method based on model fine-tuning is a coarse-grained global or local parameter adjustment, which may not be able to accurately and thoroughly remove deep-seated and strongly hidden backdoors, resulting in attack residues. Moreover, it requires multiple rounds of training during the forgetting process, which is not very time-efficient.

[0006] (3) Existing recovery methods for poisoning models of forgetting learning do not take into account the difference in the number of backdoor samples, which leads to the inability to completely remove backdoors when a small number of backdoor samples are known due to insufficient sample size. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention provides an efficient recovery method and system for electromagnetic poisoning models based on incremental forgetting learning. This method combines catastrophic forgetting and multi-copy random labeling forgetting strategies. By constructing a random labeling forgetting subset by randomly labeling backdoor samples with multiple copies, it achieves rapid forgetting of backdoor samples, i.e., efficient recovery of the backdoor poisoning model.

[0008] This invention is achieved through the following technical solution: The first invention provides an efficient recovery method for an electromagnetic poisoning model based on incremental forgetting learning, comprising the following steps: Based on the known or unknown number of backdoor samples, dynamically select and construct the corresponding forgetting training dataset, including: 1) When the backdoor sample is unknown, a set number of samples are selected from the clean samples of each category to form a catastrophic forgetting subset, which is used as the forgetting training dataset; 2) When the number of known backdoor samples is less than the first preset threshold, the known backdoor samples are first expanded, and then the expanded backdoor samples are randomly labeled with multiple copies to construct a randomly labeled forgetting subset. The randomly labeled forgetting subset is then merged with the catastrophic forgetting subset to form the forgetting training dataset. 3) When the number of backdoor samples is known and is higher than the second preset threshold, the known backdoor samples are directly randomly labeled with multiple copies to construct a randomly labeled forgetting subset, and the randomly labeled forgetting subset is merged with the catastrophic forgetting subset to form the forgetting training dataset.

[0009] The backdoor poisoning model was retrained using the forgotten training dataset to remove the influence of backdoor attacks, resulting in a restored backdoor poisoning model.

[0010] Preferably, the expansion of known backdoor samples can be carried out in any of the following ways: Direct copy extension: Directly copy the backdoor sample; Add fixed noise expansion: Add Gaussian random noise with a fixed standard deviation to the backdoor sample; Add arithmetic progression noise expansion: Add a series of Gaussian random noises with different standard deviations to the backdoor sample, the standard deviations forming an arithmetic progression sequence.

[0011] Preferably, the step of randomly labeling backdoor samples with multiple copies to construct a randomly labeled forgetting subset includes: For each backdoor sample, keeping its input features unchanged, its original label is replaced with an incorrect label selected from all non-original label category labels, thereby generating a new forgotten sample; this is done for all backdoor samples, and all the newly generated samples constitute the random labeled forgotten subset.

[0012] Preferably, the step of randomly labeling backdoor samples with multiple copies to construct a randomly labeled forgetting subset further includes: For each backdoor sample, keep its input features unchanged, replace its original label with the category labels of all non-original labels, thereby generating a new number of samples equal to the number of categories minus one; do this for all backdoor samples, and all the new samples generated constitute the random labeled forgetting subset.

[0013] Preferably, the step of selecting a predetermined number of samples from clean samples of each category to form a catastrophic forgetting subset specifically includes: Define an array to record the number of currently selected samples in each category; iterate through the clean sample dataset. For each sample, determine whether the number of samples selected in its category has not reached the preset number of samples selected per category; If the target is not reached, the sample is added to the catastrophic forgetting subset, and the count of the corresponding category in the array is updated.

[0014] Preferably, the retraining of the backdoor poisoning model using the forgotten training dataset specifically involves: The weight parameters of the backdoor poisoning model are loaded as initial parameters; Redefine the loss function, optimization function, and hyperparameters; Using the forgotten training dataset, starting with the initial parameters, the model is retrained using a redefined loss function, optimization function, and hyperparameters to obtain the recovered model.

[0015] Preferably, it also includes: evaluating the backdoor attack success rate and clean sample identification accuracy of the recovered model; The backdoor attack success rate is calculated by inputting test samples containing backdoor triggers into the recovered model and statistically analyzing the proportion of successful backdoor triggers. The clean sample recognition accuracy is calculated by inputting clean test samples into the recovered model and statistically analyzing the proportion of samples that are correctly recognized.

[0016] The second invention provides an efficient recovery system for an electromagnetic poisoning model based on incremental forgetting learning, comprising: The dataset construction module is used to dynamically select and construct the corresponding forgetting training dataset based on the number of known or unknown backdoor samples, including: 1) When the backdoor sample is unknown, a set number of samples are selected from the clean samples of each category to form a catastrophic forgetting subset, which is used as the forgetting training dataset; 2) When the number of known backdoor samples is less than the first preset threshold, the known backdoor samples are first expanded, and then the expanded backdoor samples are randomly labeled with multiple copies to construct a randomly labeled forgetting subset. The randomly labeled forgetting subset is then merged with the catastrophic forgetting subset to form the forgetting training dataset. 3) When the number of backdoor samples is known and exceeds the second preset threshold, the known backdoor samples are directly randomly labeled with multiple copies to construct a randomly labeled forgetting subset, and the randomly labeled forgetting subset is merged with the catastrophic forgetting subset to form the forgetting training dataset. The recovery module is used to retrain the backdoor poisoning model using the forgotten training dataset to remove the influence of the backdoor attack and obtain a recovered backdoor poisoning model.

[0017] The third invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to implement the steps of the method as described in any one of claims 1 to 7.

[0018] Fourth invention: This application provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when executed by a processor, the program implements the steps of the method as described in any one of claims 1 to 7.

[0019] Compared with the prior art, the present invention has the following beneficial technical effects: This application presents an efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning. By accurately sensing the known quantity of backdoor samples, it intelligently switches and executes differentiated forgetting learning strategies, achieving a high level of balance between recovery efficiency and model performance maintenance. When there is no prior knowledge of backdoor samples, a catastrophic forgetting subset is constructed for basic model recovery, ensuring basic defense capabilities. When a small number of backdoor samples are available, an innovative strategy combining sample expansion and multi-copy random labeling is introduced, effectively overcoming the problem of incomplete forgetting due to insufficient samples and significantly improving recovery robustness. When faced with a sufficient number of backdoor samples, multi-copy random labeling is directly used for efficient forgetting, avoiding unnecessary computational overhead. This scheme prioritizes maintaining the original model performance while eliminating backdoors. Through a carefully constructed catastrophic forgetting subset, the model can continuously consolidate and retain its ability to correctly distinguish benign samples while "forgetting" malicious backdoor features, thus achieving ideal results in both attack success rate and classification accuracy.

[0020] This application also proposes an efficient recovery system for an electromagnetic poisoning model based on incremental forgetting learning, an electronic device, and a computer storage medium, which possess all the advantages of the aforementioned efficient recovery method for an electromagnetic poisoning model based on incremental forgetting learning. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of the efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning, as described in this invention.

[0023] Figure 2 This is a diagram illustrating the effect of a backdoor attack based on phase rotation according to the present invention.

[0024] Figure 3 This is a diagram illustrating the effect of using catastrophic forgetting to recover the model when an unknown backdoor sample is encountered in this invention.

[0025] Figure 4 The diagram shows the effect of using catastrophic forgetting and multi-copy random labeled forgetting to recover the model without expanding the known small number of backdoor samples (1% and 2%).

[0026] Figure 5 The diagram shows the effect of model recovery using catastrophic forgetting and multi-copy random labeled forgetting after expanding the backdoor samples (1% and 2%) of the known backdoor samples in this invention.

[0027] Figure 6 The diagram illustrates the reduction in attack success rate when the known backdoor sample count is 3% and 4%, and the model recovery is performed before and after backdoor sample expansion using catastrophic forgetting and multi-copy random labeling forgetting.

[0028] Figure 7 The graph shows the model prediction accuracy before and after backdoor sample expansion using catastrophic forgetting and multi-copy random labeled forgetting, when the known number of backdoor samples is 3% and 4%.

[0029] Figure 8 The diagram illustrates the reduction in attack success rate when using catastrophic forgetting and multi-copy random labeled forgetting to recover a large number of known backdoor samples (5%~10%).

[0030] Figure 9The image shows the model prediction accuracy of this invention when using catastrophic forgetting and multiple-copy random labeling forgetting to recover a large number of known backdoor samples (5%~10%). Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0032] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0033] Example 1 An efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning is proposed, and the implementation process is as follows: Figure 1 As shown, the method includes three parts: constructing a forgetting training dataset, fine-tuning the recovery backdoor poisoning model, and evaluating the recovery effect of the poisoning model.

[0034] Step 1: Construct the forgetting training dataset For backdoor forgetting and performance recovery in backdoor poisoning models, different forgetting strategies are used to construct different forgetting training datasets based on the state and number of backdoor samples. Specifically, they can be divided into the following three cases: The backdoor sample state includes unknown backdoor samples and known backdoor samples.

[0035] Scenario 1: Unknown backdoor sample, known clean samples in each category A certain number of clean samples are selected from each category to form a catastrophic forgetting subset. .

[0036] The selection method is as follows: Define an array to record the number of samples in each category. and the number of clean samples selected for each category Traverse the clean sample dataset. Determine whether the category of each clean sample meets the requirements. If the condition is not met, the sample is added to the forgetting subset consisting of clean samples from each category. If the target has been reached, continue iterating. The selection result is shown in the following formula:

[0037] in, , Indicates the first The first selected from the categories One sample, Indicates the first Labels for each category, This represents the number of categories in the classification task.

[0038] Scenario 2: A small number of backdoor samples are known and clean samples of each category At this point, the known backdoor samples are first expanded, and then the expanded backdoor samples are... Constructing a randomly labeled forgotten subset using multiple copy random labeling .

[0039] There are three different methods for expanding backdoor samples: directly copying and expanding the backdoor sample, adding Gaussian random noise with a fixed standard deviation, and adding Gaussian random noise with equal standard deviations. The specific implementations are as follows: Directly copying extended backdoor samples: This extension method directly copies backdoor samples without making any changes. For example, to extend known 1% and 2% backdoor samples to 6%, each known 1% backdoor sample will be copied 5 times, and each known 2% backdoor sample will be copied 2 times. The specific extension formula is as follows:

[0040] in, This is an extended backdoor sample.

[0041] Backdoor sample expansion by adding Gaussian random noise with a fixed standard deviation: This expansion method adds a fixed, small amount of Gaussian random noise to the backdoor samples to expand them. For example, to expand 1% and 2% of known backdoor samples to 6% by adding Gaussian random noise with a standard deviation of 0.01, each backdoor sample with 1% known samples would be expanded by adding 5 Gaussian random noises with a standard deviation of 0.01 to each sample, thus expanding each sample by 5 parts. Similarly, with 2% known backdoor samples, each backdoor sample would be expanded by adding 2 Gaussian random noises with a standard deviation of 0.01 to each sample, thus expanding each sample by 2 parts. The specific expansion formula is as follows:

[0042] in, For the expanded sample, The sum of the dimensions of the Gaussian random noise with a standard deviation of 0.01 is given. They have the same dimensions.

[0043] Backdoor sample expansion by adding Gaussian random noise with arithmetic standard deviations: This expansion method expands backdoor samples by adding different small Gaussian random noises. For example, to expand 1% and 2% of known backdoor samples to 6% by adding Gaussian random noise with standard deviations of 0.01~0.05, each sample is expanded by adding 5 Gaussian random noises with standard deviations of 0.01~0.05 to each known backdoor sample. Similarly, to expand 2% of known backdoor samples by adding 2 Gaussian random noises with standard deviations of 0.01 and 0.02 to each known backdoor sample, each sample is expanded by adding 2 Gaussian random noises with standard deviations of 0.01 and 0.02 to each known backdoor sample. The specific expansion formula for 1% known backdoor samples is as follows: ,

[0044] in, For the expanded sample, The standard deviation is Gaussian random noise with dimensions and The same dimensions express The value ranges from 0.01 to 0.05, with a 0.01 interval between each value.

[0045] After expanding the backdoor samples, a fast forgetting subset is constructed using multi-copy random annotation. Multiple copy random labeling refers to maintaining the expanded backdoor samples Input features The label remains unchanged; instead, each sample's label is changed to a label other than the backdoor sample's label. This means discarding the original backdoor sample's label and then assigning each sample a different incorrect label. Assume the original sample is... So many copies of the random labeling are from the forgotten label set. Select all tags and To combine and form A new sample. The specific formula is as follows:

[0046] Among them, the forgotten label set That is, it includes samples excluding backdoors. Other category labels, The number of categories in the classification task. For backdoor samples The forgotten samples obtained by performing multiple-copy random labeling are combined with the forgotten samples obtained by performing multiple-copy random labeling on all expanded backdoor samples to form a multiple-copy random labeling forgotten subset. .

[0047] Scenario 3: A large number of backdoor samples are known (Given that the number of backdoor samples is greater than 5%) and some clean samples in each category The backdoor samples are directly labeled with multiple copies to form a multiple copy random labeled forgetting subset. .

[0048] Catastrophic forgetting subsets constructed directly from partially clean samples of each category when the backdoor samples are unknown. This constitutes the catastrophic forgetting training dataset. It is a subset of catastrophic forgetting constructed from partially clean samples of each class, given both small and large numbers of known backdoor samples. Constructing a multi-copy randomly labeled forgotten subset using backdoor samples with multiple copies of random labels This is combined with a catastrophic and multi-copy randomly labeled forgetting training dataset. In summary, the backdoor poisoning model forgetting training dataset... The formula is as follows:

[0049] Step 2: Fine-tune the recovery backdoor poisoning model Using the forgotten training dataset Backdoor poisoning model Retraining is performed, i.e., continuing to use the backdoor poisoning model. Redefine the loss function based on the weight parameters. Optimization function and hyperparameters Then use the forgotten training dataset Continue training the backdoor poisoning model The model will detect backdoor samples implanted by attackers. Forgotten, the model after the backdoor poisoning model is restored. The specific formula is as follows:

[0050] in, In the forgotten dataset The above model Using loss function Optimization function and hyperparameters Retrain.

[0051] Step 3: Evaluation of the recovery effect of the backdoor poisoning model There are two evaluation metrics for the effectiveness of backdoor poisoning model recovery: Backdoor Attack Success Rate (ASR) and Clean Sample Recognition Accuracy (ACC). The ASR is the most important metric for evaluating backdoor attacks and is also a key metric in backdoor poisoning model recovery. The most direct goal of backdoor poisoning model recovery is to reduce the backdoor attack success rate; the lower the success rate, the better the recovery effect. A test set of backdoor samples containing backdoor triggers is used. For the restored model The attack success rate, as measured in the tests, represents the number of times the backdoor was successfully triggered. Divide by the total number of attacks The formula for calculating the attack success rate (ASR) is as follows:

[0052] Clean sample recognition accuracy is used to evaluate whether backdoor poisoning model recovery affects model performance. The closer the clean sample recognition accuracy is to the prediction accuracy of the normal model, the better the effect of backdoor poisoning model recovery. A clean sample test set is used. For the restored model The clean sample recognition accuracy rate, as measured in the tests, represents the number of times a clean sample is successfully identified. Divide by the number of predictions The formula for calculating the clean sample identification accuracy (ACC) is as follows:

[0053] This efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning combines catastrophic forgetting and multi-copy random labeling forgetting strategies. It constructs a randomly labeled forgetting subset by randomly labeling backdoor samples using multi-copy random labeling, achieving rapid forgetting of backdoor samples and thus efficient recovery of the backdoor poisoning model. By constructing catastrophic forgetting subsets from partially clean samples in each category, it recovers the backdoor poisoning model while preserving the model's prediction accuracy for benign samples. Furthermore, when faced with insufficient backdoor samples, it expands the backdoor sample pool through various methods, solving the problem of insufficient sample size preventing complete backdoor removal when only a small number of backdoor samples are known.

[0054] The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning proposed in this application has the following advantages: Different forgetting strategies are used depending on the number of known backdoor samples. Specifically, there are three scenarios: 1. When the number of backdoor samples is unknown, a forgetting training set is constructed using clean samples from each category. This training set is then used to retrain the backdoor poisoning model for catastrophic forgetting, achieving effective recovery of the backdoor poisoning model. 2. When a small number of backdoor samples are known, the known backdoor samples are first expanded, and then multiple copies of the expanded backdoor samples are randomly labeled to construct a randomly labeled forgetting subset. 3. When a large number of backdoor samples are known (the number of known backdoor samples is greater than 5%), multiple copies of the backdoor samples are directly randomly labeled to construct a randomly labeled forgetting subset. Then, the randomly labeled forgetting subset is combined with clean samples from each category to form a catastrophic and multiple-copy randomly labeled forgetting training set. This training set is then used to retrain the backdoor poisoning model for catastrophic and multiple-copy randomly labeled forgetting, achieving efficient recovery of the backdoor poisoning model.

[0055] When faced with insufficient backdoor samples to completely eliminate backdoors, this invention employs multiple methods to expand known backdoor samples, including direct copying, adding Gaussian random noise with a fixed standard deviation, and adding Gaussian random noise with equal standard deviations. When there are enough backdoor samples, this invention, for each backdoor sample, keeps its input features unchanged, changes its label to a label of another category not specified by the backdoor sample itself, and performs multiple copies of random labeling to achieve rapid forgetting of backdoor samples.

[0056] The efficient recovery method for the electromagnetic poisoning model based on incremental forgetting learning was tested.

[0057] A phase-rotation-based backdoor attack poisoning model was used as the baseline model for the experiment. Phase-rotation-based backdoor attacks are Trojan horse attacks targeting automatic modulation classification in wireless communications. The deep learning model uses raw (I / Q) samples as features and modulation type as labels to achieve automatic modulation identification of wireless signals. Attackers implant backdoors into a small number of training data samples by modifying the phase of the samples (i.e., adding triggers) and changing the labels of these samples to the target label. These backdoor samples are inserted into clean training data to train the deep learning model. During the testing phase, the deep learning model can accurately classify clean (untriggered) signal samples, but when the same phase shift (trigger) is added to a signal sample, the model identifies this signal sample as belonging to the attacker's target label. The specific formula for adding triggers in the phase-rotation-based backdoor attack is as follows:

[0058] in, and This represents the (I / Q) sample value without the trigger added. Indicates the angle of phase rotation. and This represents the (I / Q) sample value after adding the trigger. Figure 2 This paper demonstrates the effectiveness of a backdoor attack based on phase rotation. The experiment uses VTCNN2 as the signal modulation recognition model and RML2016.10a as the dataset. Backdoor attacks are performed on signal samples with CPFSK modulation type at a signal-to-noise ratio of 2–18 dB, while the target label's modulation type is QPSK. Observation Figure 2 It can be observed that using phase rotation to perform backdoor attacks on the model achieves a success rate of over 95% and a model prediction accuracy of 82%. The experimental part of this invention currently focuses on the recovery of a poisoned model from a backdoor attack based on phase rotation. Other backdoor attack methods, such as those based on Gaussian random noise, can be compared to this poisoned model recovery method.

[0059] Figure 3 The experiment demonstrates the backdoor attack success rate and clean sample prediction accuracy of the model after model recovery using catastrophic forgetting when unknown backdoor samples are present. Observing the backdoor attack success rate results, it can be seen that the backdoor attack success rate can be reduced to below 10% when unknown backdoor samples are present, but the success rate only begins to converge gradually after the 175th retraining epoch. Observing the clean sample prediction accuracy results, it can be seen that the clean sample prediction accuracy remains almost unchanged compared to the clean model when the backdoor poisoned model is recovered, indicating that the recovery process has little impact on model performance.

[0060] Figure 4 This paper presents experiments with known backdoor samples, specifically 1% and 2% of the samples. The results demonstrate the backdoor attack success rate and clean sample prediction accuracy of the model after recovery using catastrophic forgetting and multi-copy random labeling forgetting without expanding the backdoor samples. The experimental results show that while the recovery process has a small impact on model performance without expanding the backdoor samples, the limited number of known backdoor samples is insufficient for complete forgetting. This is particularly evident when the known backdoor sample count is 1%, where the backdoor attack success rate only drops to 20%. More importantly, multi-copy random labeling of the limited number of known backdoor samples generates samples with backdoor features but not the target label. These samples influence catastrophic forgetting, and even after multiple training epochs, the convergence value of the model's backdoor attack success rate is still higher than that achieved using catastrophic forgetting directly.

[0061] Figure 5The experiment demonstrates the backdoor attack success rate and clean sample prediction accuracy of the model after expanding the backdoor sample count to 6% with known backdoor samples (1% and 2%), using catastrophic forgetting and multiple-copy random labeling forgetting for model recovery. Observing the backdoor attack success rate results, it can be seen that when the known backdoor sample count is 1% and 2%, expanding the backdoor sample count reduces the backdoor attack success rate to below 10%, and the success rate converges after the 60th retraining epoch. Meanwhile, observing the clean sample prediction accuracy results shows that the clean sample prediction accuracy remains almost unchanged compared to the clean model during backdoor poisoning model recovery, indicating that the recovery process has minimal impact on model performance.

[0062] Figure 6 and Figure 7 This study demonstrates the backdoor attack success rate and clean sample prediction accuracy of the model after backdoor sample expansion, using catastrophic forgetting and multi-copy random labeled forgetting, with a known backdoor sample count of 3% and 4%. Experimental results show that with a known backdoor sample count of 3% and 4%, both backdoor sample expansion and backdoor attack success rate reductions can be achieved to below 5%, and the recovery process has minimal impact on model performance. Furthermore, adding Gaussian noise with a standard deviation of std=0.05 to the backdoor samples and doubling the number of backdoor samples improves the forgetting effect of the backdoor samples and the convergence speed of the poisoned model's backdoor attack success rate, achieving more efficient poisoned model recovery.

[0063] Figure 8 and Figure 9 This study demonstrates the backdoor attack success rate and clean sample prediction accuracy of the model after model recovery using catastrophic forgetting and multi-copy random labeling forgetting, with a known number of backdoor samples ranging from 5% to 10%. Observing the backdoor attack success rate experimental results, it can be seen that when the number of known backdoor samples exceeds 5%, the model's backdoor attack success rate can be reduced to below 5%. The backdoor attack success rate converges before the 45th retraining epoch, and the convergence rate of the poisoned model's backdoor attack success rate increases faster with the increase in the number of backdoor samples. Meanwhile, the clean sample prediction accuracy of the poisoned model during backdoor recovery remains almost unchanged compared to the clean model, indicating that the recovery process has minimal impact on model performance.

[0064] Comprehensive experimental results demonstrate that the proposed efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning can reduce the backdoor attack success rate (ASR) to below 10% even with known and unknown backdoor samples, while ensuring that the model's accuracy in identifying clean samples (ACC) remains essentially unchanged, thus maximizing the preservation of the model's original performance. This method achieves this goal through a dynamic strategy: catastrophic forgetting is used for effective recovery when backdoor samples are unknown; when backdoor samples are known, a combination of catastrophic forgetting and multi-copy random labeling forgetting strategies is employed to achieve efficient recovery. Its core advantage lies in the minimal impact of the recovery process on model performance, and the significant increase in recovery speed with the increase in the number of known backdoor samples.

[0065] Correspondingly, this application also provides an efficient recovery system for an electromagnetic poisoning model based on incremental forgetting learning, comprising: The dataset construction module is used to dynamically select and construct the corresponding forgetting training dataset based on the number of known or unknown backdoor samples, including: 1) When the backdoor sample is unknown, a set number of samples are selected from the clean samples of each category to form a catastrophic forgetting subset, which is used as the forgetting training dataset; 2) When the number of known backdoor samples is less than the first preset threshold, the known backdoor samples are first expanded, and then the expanded backdoor samples are randomly labeled with multiple copies to construct a randomly labeled forgetting subset. The randomly labeled forgetting subset is then merged with the catastrophic forgetting subset to form the forgetting training dataset. 3) When the number of backdoor samples is known and exceeds the second preset threshold, the known backdoor samples are directly randomly labeled with multiple copies to construct a randomly labeled forgetting subset, and the randomly labeled forgetting subset is merged with the catastrophic forgetting subset to form the forgetting training dataset. The recovery module is used to retrain the backdoor poisoning model using the forgotten training dataset to remove the influence of the backdoor attack and obtain a recovered backdoor poisoning model.

[0066] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0067] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0068] An electronic device provided in this application includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the efficient recovery method for the electromagnetic poisoning model based on incremental forgetting learning as described in any of the above embodiments.

[0069] Another electronic device provided in this application embodiment may further include: an input port connected to a processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processor's processing results to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module includes, but is not limited to, Mobile High Definition Link (HML), Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), and wireless connection (including Wi-Fi, Bluetooth, Bluetooth Low Energy, and IEEE 802.11s-based communication technology).

[0070] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the efficient recovery method for the electromagnetic poisoning model based on incremental forgetting learning as described in any of the above embodiments.

[0071] For descriptions of relevant parts in the efficient recovery system, electronic device, and computer-readable storage medium based on incremental forgetting learning for electromagnetic poisoning models provided in this application's embodiments, please refer to the detailed descriptions of the corresponding parts in the efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning provided in this application's embodiments; they will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0072] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. An efficient recovery method for an electromagnetic poisoning model based on incremental forgetting learning, characterized in that, Includes the following steps: Based on the known or unknown number of backdoor samples, dynamically select and construct the corresponding forgetting training dataset, including: 1) When the backdoor sample is unknown, a set number of samples are selected from the clean samples of each category to form a catastrophic forgetting subset, which is used as the forgetting training dataset; 2) When the number of known backdoor samples is less than the first preset threshold, the known backdoor samples are first expanded, and then the expanded backdoor samples are randomly labeled with multiple copies to construct a randomly labeled forgetting subset. The randomly labeled forgetting subset is then merged with the catastrophic forgetting subset to form the forgetting training dataset. 3) When the number of backdoor samples is known and exceeds the second preset threshold, the known backdoor samples are directly randomly labeled with multiple copies to construct a randomly labeled forgetting subset, and the randomly labeled forgetting subset is merged with the catastrophic forgetting subset to form the forgetting training dataset. The backdoor poisoning model was retrained using the forgotten training dataset to remove the influence of backdoor attacks, resulting in a restored backdoor poisoning model.

2. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 1, characterized in that, The expansion of known backdoor samples can be achieved using any of the following methods: Direct copy extension: Directly copy the backdoor sample; Add fixed noise expansion: Add Gaussian random noise with a fixed standard deviation to the backdoor sample; Add arithmetic progression noise expansion: Add a series of Gaussian random noises with different standard deviations to the backdoor sample, the standard deviations forming an arithmetic progression sequence.

3. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 1, characterized in that, The step of randomly labeling backdoor samples multiple times to construct a randomly labeled forgetting subset includes: For each backdoor sample, keeping its input features unchanged, its original label is replaced with an incorrect label selected from all non-original label category labels, thereby generating a new forgotten sample; this is done for all backdoor samples, and all the newly generated samples constitute the random labeled forgotten subset.

4. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 3, characterized in that, The step of randomly labeling backdoor samples multiple times to construct a randomly labeled forgetting subset further includes: For each backdoor sample, keep its input features unchanged, replace its original label with the category labels of all non-original labels, thereby generating a new number of samples equal to the number of categories minus one; do this for all backdoor samples, and all the new samples generated constitute the random labeled forgetting subset.

5. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 1, characterized in that, The selection of a predetermined number of samples from clean samples across various categories to form a catastrophic forgetting subset specifically includes: Define an array to record the number of currently selected samples in each category; iterate through the clean sample dataset. For each sample, determine whether the number of samples selected in its category has not reached the preset number of samples selected per category; If the target is not reached, the sample is added to the catastrophic forgetting subset, and the count of the corresponding category in the array is updated.

6. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 1, characterized in that, The retraining of the backdoor poisoning model using the forgotten training dataset specifically involves: The weight parameters of the backdoor poisoning model are loaded as initial parameters; Redefine the loss function, optimization function, and hyperparameters; Using the forgotten training dataset, starting with the initial parameters, the model is retrained using a redefined loss function, optimization function, and hyperparameters to obtain the recovered model.

7. The efficient recovery method for electromagnetic poisoning models based on incremental forgetting learning according to claim 1, characterized in that, Also includes: Evaluate the backdoor attack success rate and clean sample identification accuracy of the recovered model; The backdoor attack success rate is calculated by inputting test samples containing backdoor triggers into the recovered model and statistically analyzing the proportion of successful backdoor triggers. The clean sample recognition accuracy is calculated by inputting clean test samples into the recovered model and statistically analyzing the proportion of samples that are correctly recognized.

8. A highly efficient recovery system for an electromagnetic poisoning model based on incremental forgetting learning, characterized in that, include: The dataset construction module is used to dynamically select and construct the corresponding forgetting training dataset based on the number of known or unknown backdoor samples, including: 1) When the backdoor sample is unknown, a set number of samples are selected from the clean samples of each category to form a catastrophic forgetting subset, which is used as the forgetting training dataset; 2) When the number of known backdoor samples is less than the first preset threshold, the known backdoor samples are first expanded, and then the expanded backdoor samples are randomly labeled with multiple copies to construct a randomly labeled forgetting subset. The randomly labeled forgetting subset is then merged with the catastrophic forgetting subset to form the forgetting training dataset. 3) When the number of backdoor samples is known and exceeds the second preset threshold, the known backdoor samples are directly randomly labeled with multiple copies to construct a randomly labeled forgetting subset, and the randomly labeled forgetting subset is merged with the catastrophic forgetting subset to form the forgetting training dataset. The recovery module is used to retrain the backdoor poisoning model using the forgotten training dataset to remove the influence of the backdoor attack and obtain a recovered backdoor poisoning model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images